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PHRACK 3 9 


June 26, 1992 


“You’re Not Dealing With AT&T™ 


Welcome to Phrack 39. This will be the final issue before SummerCon ’92. 
Details of SummerCon will appear in our special anniversary issue due late this 
summer -—- Phrack 40. Rumor also has it that the next issue of Mondo 2000 will 


contain some type of coverage about SummerCon as well! 


Phrack has been receiving an enormous amount of mail containing questions and 
comments from our readers and we really appreciate the attention, but we don’t 
know what to do with it all. Phrack Loopback was created to address letters of 
this sort, but in a lot of cases, the senders of the mail are not indicating if 
t 
t 


heir question is to be posted to Loopback or if they are to be identified as 
he author of their question in Loopback. 


Dispater has been moving all across the country over the past couple of months, 
which is the primary reason for the delay in releasing this issue. However, 
now that he is settled, the fun is about to begin. He will be responding to 
your mail very soon and hopefully this will all be sorted out by issue 40. 

For right now, you can enjoy a variety of special interest articles and letters 
in this issue’s Loopback, including "A Review of Steve Jackson Games’ HACKER" 


by Deluge. Special thanks goes out to Mentor and Steve Jackson for a copy of 
the game and the totally cool looking poster. "Association of Security 
Sysadmins" is my favorite! ;) 

Another problem situation that needs to be mentioned has to do with would-be 
subscribers. For some reason the "phracksub@stormking.com" account has been 
receiving hundreds of requests from people who want to be added to the 
subscription list. This isn’t how it works. You must subscribe yourself, we 


can’t and won’t do it for you. The instructions are included later in this 
file. Up till this point we have been informing people of their error and 
mailing them the instructions, but we will ignore these requests from now on. 
Anyone with an intelligence level high enough to enjoy Phrack should be capable 
of figuring out how to subscribe. 


Phrack Pro-Phile focuses on Shadow Hawk 1 -- The first hacker ever to be 
prosecuted under the Computer Fraud & Abuse Act of 1986. A lot of people don’t 
realize that Robert Morris, Jr. was not the first because Shadow Hawk 1 was 
tried as a minor and therefore a lot of details in his case are not publicly 
known. Something to point out however is that the same people (William J. Cook 
and Henry Klupfel) that were responsible for prosecuting SH1 in 1989, came back 
in 1990 to attack Knight Lightning... but this time the government and Bellcore 
didn’t fare as well and now both Cook and Klupfel (among others) are being sued 
in Federal Court in Austin, Texas (See Steve Jackson Games v. United States). 


Now, before anyone starts flying off their keyboards screaming about our 
article "Air Fone Frequencies" by Leroy Donnelly, we will let you know what’s 


what. Yes, the same article did recently appear in Informatik, however, both 
publications received it from the same source (Telecom Digest) and Informatik 
just had an earlier release date. At Phrack, we feel that the information was 


interesting and useful enough that our readers deserved to see it and we do not 
assume by any means that everyone on the Phrack list is also a reader of 
publications like Telecom Digest or Informatik. 


Phrack’s feature article in this issue is "The Complete Guide To The DIALOG 
Information Network" by Brian Oblivion. Our undying gratitude to Mr. Oblivion 
for his consistency in providing Phrack and its readers with entertaining 
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quality articles... and we’re told that the best is yet to come. 
Longtime fans of Phrack might recall that Phrack 9 had an article on Dialog 


services and it also had an article on Centigram Voice Mail. Now 30 issues 
later, both topics are resurrected in much greater detail. 


You will also note that the Centigram article in this issue is penned under th 
pseudonym of ">Unknown User<," a name that was adopted from the anonymous 
posting feature of the Metal Shop Private bulletin board (the birthplace of 


Phrack, sysoped by Taran King during 1985-1987). The name ">Unknown User<" has 
traditionally been reserved for authors who did not wish to be identified in 
any capacity other than to the Phrack editors. In this case, however, even th 


staff at Phrack has absolutely no idea who the author of this file is because 
of the unique way of SMTP Fakemail it was delivered. 


No Pirates’ Cove in this issue. Be watching for the next Pirates’ Cove in 
Phrack 40. 


Knight Lightning recently spoke at the National Computer Security Association’s 
Virus Conference in Washington, D.C. His presentation panel which consisted 

of himself, Winn Schwartau (author of Terminal Compromise), and Michael 
Alexander (chief editor of ISPNews and formally an editor and reporter for 
ComputerWorld) was very well received and the people attending the conference 
appeared genuinely interested in learning about the hacking community and 
computer security. KL remarked that he felt really good about the public’s 
reaction to his presentation because "its the first time, I’ve agreed to be on 
one of these panels and someone in the audience hasn’t made accusatory or 
derogatory remarks." 


"It’s inappropriate for you to be here." 


This was the warm reception KL and a few others received upon entering the 
room where the secret midnight society anti-virus group was holding a meeting. 
It appears that a small number of anti-virus "experts" have decided to embark 
on a mission to rid the country of computer bulletin boards that allow the 
dissemination of computer viruses... by any means possible, including the 
harassment of the sysops (or the sysops’ parents if the operator is a minor). 


At Phrack, some of us feel that there are no good viruses and are opposed to 
their creation and distribution. Others of us (e.g. Dispater) just think 
viruses are almost as boring as the people who make a carear out of 
exterminating them. However, we do not agree with the method proposed by this 
organization and will be watching. 


Special thanks for help in producing this issue: 


Beta-Ray Bill Crimson Flash (512) 

Datastream Cowboy Deluge 

Dispater, EDITOR Dokkalfar 

Frosty (of CyberSpace Project) Gentry 

The Iron Eagle (of Australia) JJ Flash 

Knight Lightning, Founder Mr. Fink 

The Omega [RDT] [-cDc—] The Public 

Rambone Ripper of HALE 

Tuc White Knight [RDT] [-cDc-—] 
We’ re Back and We’re Phrack! 


HOW TO SUBSCRIBE TO PHRACK MAGAZIN 


GJ 


The distribution of Phrack is now being performed by the software called 
Listserv. All individuals on the Phrack Mailing List prior to your receipt of 
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this letter have been deleted from the list. 


If you would like to re-subscribe to Phrack Inc. please follow these 
instructions: 


1. Send a piece of electronic mail to "LISTSERV@STORMKING.COM". The mail 
must be sent from the account where you wish Phrack to be delivered. 


2. Leave the "Subject:" field of that letter empty. 


3. The first line of your mail message should read: 
SUBSCRIBE PHRACK <your name here> 


4. DO NOT leave your address in the name field! 
(This field is for PHRACK STAFF use only, so please use a full name) 


Once you receive the confirmation message, you will then be added to the Phrack 


Mailing List. If you do not receive this message within 48 hours, send another 
message. If you STILL do not receive a message, please contact 
"SERVER@STORMKING.COM". 


You will receive future mailings from "PHRACK@STORMKING.COM". 


If there are any problems with this procedure, please contact 
"SERVER@STORMKING.COM" with a detailed messag 


You should get a conformation message sent back to you on your subscription. 


Table Of Contents 


1. Introduction by Dispater and Phrack Staff 12K 
2. Phrack Loopback by Phrack Staff 24K 
3. Phrack Pro-Phile on Shadow Hawk 1 by Dispater 8K 
4. Network Miscellany V by Datastream Cowboy 34K 
5. DIALOG Information Network by Brian Oblivion 43K 
6 Centigram Voice Mail System Consoles by >Unknown User< 36K 
7. Special Area Codes II by Bill Huttig 17K 
8. Air Fone Frequencies by Leroy Donnelly 14K 
9. The Open Barn Door by Douglas Waller (Newsweek) 11K 
10. PWN/Part 1 by Datastream Cowboy 30K 
11. PWN/Part 2 by Datastream Cowboy 27K 
12. PWN/Part 3 by Datastream Cowboy 29K 
13. PWN/Part 4 by Datastream Cowboy 29K 
Total: 314K 
"Phrack. If you don’t get it, you don’t get it." 
phracksub@stormking.com 
Somebody Watching? Somebody Listening? 


*** Special Announcement *** 


[7] 


KNIGHT LIGHTNING TO SPEAK AT SURVEILLANC 
Washington, DC 


EXPO /92 


The Fourth Annual International Surveillance and Countersurveillance Conference 
and Exposition focusing on Information Security and Investigations Technology 
will take place at the Sheraton Premiere in Tysons Corner (Vienna), Virginia on 
August 4-7. 


The seminars are on August 7th and include Craig Neidorf (aka Knight Lightning) 
presenting and discussing the following: 
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7 Are law enforcement and computer security officials focusing their 
attention on where the real crimes are being committed? 


7 Should security holes and other bugs be made known to the public? 


= Is information property and if so, what is it worth? 


Experience the case that changed the way computer crime is investigated 
and prosecuted by taking a look at one of America’s most talked about 
computer crime prosecutions: United States v. Neidorf (1990). 


Exonerated former defendant Craig Neidorf will discuss the computer 
"hacker" underground, Phrack newsletter, computer security, and how it all 
came into play during his 7 month victimization by some of our nation’s 
largest telephone companies and an overly ambitious and malicious federal 
prosecutor. Neidorf will speak about his trial in 1990 and how the court 
dealt with complex issues of First Amendment rights, intellectual 
property, and criminal justice. 


Security professionals, government employees, and all other interested parties 
are invited to attend. For more information please contact: 


American Technology Associates, Inc. 
P.O. Box 20254 

Washington, DC 20041 

(202) 331-1125 Voice 

(703) 318-8223 FAX 
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==Phrack Inc.== 


Volume Four, Issue Thirty-Nine, File 2 of 13 


[-=:< Phrack Loopback >:=-] 
By Phrack Staff 


Phrack Loopback is a forum for you, the reader, to ask questions, air 
problems, and talk about what ever topic you would like to discuss. This is 
also the place Phrack Staff will make suggestions to you by reviewing various 
items of note; magazines, software, catalogs, hardware, etc. 


A Review of Steve Jackson Games’ HACKER 


By Deluge 


They had to get around to it eventually. While I was scanning the game section 
at the not-so-well-stocked game and comic store where I shop on occasion, I saw 
something that caught my eye: A game called "Hacker" by Steve Jackson Games. 


What you see on the cover gives you a clue that this game is a bit more than 


the typical trash we see about hackers. Here we have a guy with a leather 
jacket with a dinosaur pin, John Lennon shades, a Metallica shirt, and a really 
spiffy spiked hairdo. This guy has an expression with a most wicked grin, and 


his face is bathed in the green glow of a monitor. Various decorations in the 
room include a model rocket, a skateboard, a pizza box, and a couple of Jolt 
Cola cans. Behind him, hanging on his wall, are a couple of posters, one which 
says, "Legion of Doom Internet World Tour," and another which says, "Free the 
Atlanta Three." On his bookshelf, we see a copy of Neuromancer, Illuminati 
BBS, and The Phoenix-- (I assume "Project" follows, and don’t ask me why this 
guy has BBSes in his bookshelf). Finally, there’s a note tacked to the LOD 
poster that says "PHRACK SummerCon CyberView, St. Louis" which appears to be an 
invitation of some kind. 


This struck me as quite interesting. 


[Twenty bucks interesting, as it turns out, and I think it was twenty well 
spent. Now don’t tell me Steve Jackson Games has no significance for you 
(sigh). Ok, here is how Steve tells it (in the intro to the game): 


"In 1990, Steve Jackson Games was raided by the U.S. Secret Service during a 
‘hacker hunt’ that went disastrously out of control. We lost several 
computers, modems, and other equipment. Worse, we lost the manuscripts to 
several uncompleted games, most notably _GURPS Cyberpunk_, which a Secret 
Service agent the next day called ’a handbook for computer crime.’ The company 
had to lay off half its staff, and narrowly avoided bankruptcy. 


"Eventually we got most of our property back (though some of it was damaged or 
destroyed). The Secret Service admitted that we’d never been a target of their 
investigation. We have a lawsuit pending against the officials and agencies 
responsible. 


"But since the day of the raid, gamers have been asking us, ’When are you going 
to make a game about it?’ Okay. We give up. Here it is. Have fun." 


Weeeell...everybody naturally wants to look as good as they can, right? For 
the real lowdown on the whole situation, a scan through some old CUDs would be 
in order, where you could find a copy of the warrant which authorized this 
raid. I can tell you that Loyd Blankenship is the author of SJG’s _GURPS 
Cyberpunk_, so draw your own conclusions. 


Hacker is played with cards. This does NOT, in my view, make it a card game, 
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though it is advertised that way. It’s pretty similar to Illuminati, requiring 
a lot of diplomacy, but it has a totally different flavor. 


The goal here is to become the mondo superhacker king of the net by getting 
access on twelve systems. You build the net as you go along, upgrading your 
system, hacking systems, and looking for ways to screw your fellow hackers so 
they can’t be king of the net before you can get around to it. While the 
hacking aspect is necessarily resolved by a dice roll, the other aspects of 
this game ring true. They distinguish between regular and root access on 
systems, have specific OSes, specific net types, NetHubs, secret indials, back 
doors, and, of course, the feds, which range from local police to combined 
raids from the FBI and other government authorities. 


This is a good game all on its own. It’s fun, it has a fair amount of 
strategy, lots of dirty dealing, and a touch of luck to spice things up. And 
if things get too hairy and blood is about to flow, they inevitably cool down 
when someone uses a special card. Quite a few of these are funny as hell. 

Some examples: 


Trashing: Somebody threw away an old backup disk. Bad idea. You can leave 
them e-mail about it...from their own account. 
Get A Life: A new computer game ate your brain. 100 hours later, you beat it, 
and you’re ready to get back to hacking, but you get only one hack 
this turn. There is another one of these about meeting a member 


of the opposite sex and briefly entertaining the notion that there 
is more to life than hacking. 


Original Manuals: The official system manuals explain many possible security 
holes. This is good. Some system administrators ignore 
them. This is bad. They usually get away with it because 
most people don’t have the manuals. This is good. But 
YOU have a set of manuals. This is very interesting. 


Social Engineering: "This is Joe Jones. My password didn’t work. Can you 
reset it to JOE for me?" There is another one of these 
that says something about being the phone company checking 
the modem line, what’s your root password please. 


And my favorite, a card designed to be played to save yourself from a raid: 


Dummy Equipment: The investigators took your TV and your old Banana II, but 
they overlooked the real stuff! No evidence, no bust -- and 
you keep your system. 


As you can see, this game goes pretty far toward catching the flavor of the 
real scene, though some of it is necessarily stereotypical. Well, enough 
praise. Here are a couple of gripes. 


The game is LONG. A really nasty group of players can keep this going for 
hours. That isn’t necessarily a bad thing, but be forewarned. A few 
modifications to shorten it up are offered, but the short game is a little like 
masturbating. Just not as good as the real thing. 


There was too much work to get the game ready to play. I’ve gotten used to 
some amount of setting up SJGs, and believe me, I would not have bought more 
unless they were good, and they always are, but the setup has not usually been 
such a pain. HACKER has a lot of pieces, anda lot of them come on a single 
page, requiring you to hack them out with scissors and hope you don’t do 
something retarded like cut the wrong thing off. Once I got done with this, 
everything was cool, but this was a real pain. 


So, overall, what do I think? Four stars. If you play games, or if you’re 
just massively hip to anything about hacking, get this game. You’re gonna need 
at least three players, preferably four or five (up to six can play), so if 

you only know one person, don’t bother unless you have some hope of getting 
someone else to game with you. 
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And when Dr. Death or the K-Rad Kodez Kid calls you up and wonders where you’ve 
been lately, just tell him you’re busy dodging feds, covering your tracks, and 
hacking for root in every system you find in your quest to call yourself king 
of the net, and if he doesn’t support you...well, you know what to do with 
posers who refuse to believe you’re God, don’t you? 


Muahahahahahahaahaha! 


CPSR Listserv 

Computer Professionals for Social Responsibility (CPSR) has set up a list 
server to (1) archive CPSR-related materials and make them available on 
request, and (2) disseminate relatively official, short, CPSR-related 
announcements (e.g., press releases, conference announcements, and project 
updates). It is accessible via Internet and Bitnet e-mail. Mail traffic will 
be light; the list is set up so that only the CPSR Board and staff can post to 
it. Because it is self-subscribing, it easily makes material available to a 
wide audience. 


We encourage you to subscribe to the list server and publicize it widely, 
to anyone interested in CPSR’s areas of work. 


To subscribe, send mail to: 


listserv@gwuvm.gwu.edu (Internet) OR 
listserv@gwuvm (Bitnet) 


Your message needs to contain only one line: 
subscribe cpsr <your first name> <your last name> 


You will get a message that confirms your subscription. The message also 
explains how to use the list server to request archived materials (including 
an index of everything in CPSR’s archive), and how to request more information 
about the list server. 


Please continue to send any CPSR queries to cpsr@csli.stanford.edu. 


If you have a problem with the list server, please contact the administrator, 
Paul Hyland (phyland@gwuvm.gwu.edu or phyland@gwuvm) . 


We hope you enjoy this new service. 


TRW Allows Inspection 
According to USA Today, as of April 30, you can get a free copy of your TRW 
credit report once a year by writing to: 


TRW Consumer Assistance 
P.O. Box 2350 
Chatsworth, CA 91313-2350 


Include all of the following in your letter: 


—- Full name including middle initial and generation such as Jr, Sr, III etc. 
—- Current address and ZIP code. 

- All previous addresses and ZIPs for past five years. 

— Social Security number. 

- Year of birth. 

— Spouse’s first name. 


-— A photocopy of a billing statement, utility bill, driver’s license or other 
document that links your name with the address where the report should be 
mailed. 
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Do the words of the prophet Abraham Epstein ring true? (Remember him from his 
correspondence in Phrack 36 Loopback?) 


If you don’t believe that The IBM/TV Power Computer and is attempting to take 
over the world then read the following and judge for yourself. 


o IBM is the worlds largest corporation. 

o IBM has more in assets than most small countries. 

o In 1991 IBM and it’s arch enemy, Apple Computer, have joined forces to build 
the POWER computer. 

o The POWER computer will replace all existing Macintosh, PS/2, and 
RS/6000 machines. 

o The POWER architecture will be licenced to third-party companies in order 
that they may build their own POWER computers. 

o With both Apple Computer (QuickTime) and IBM (Ultimedia) advancing their 
work on Multimedia, it can only mean that the POWER computer will speak 
through TV. 

H are some quotes from Harley Hahn of IBM’s Advanced Workstation Division: 


"PowerOpen is a computing architecture based on AIX and the POWER 
Architecture. To that we’ve added the PowerPC architecture [a low- 
end implementation if POWER ] and the Macintosh interface and 
applications." 


"Our goal is to create the major RISC computing industry standard 
based on the PowerPC architecture and the PowerOpen environment." 


Eventually all our workstations will use POWER" 


Here’s a quote from Doug McLean of Apple Computer: 


"It is our intention to replace the 68000 in our entire line of 
Macintosh computers with PowerPC chips." 


The PROPHECY IS COMING TRUE. We have no time to lose. Unless we act quickly 


the world will come to an abrupt end as the POWER COMPUTER passes wind on all 


of us. 


Abraham Epstein [Big Daddy Plastic Recycling Corporation] 


[Plastic Operations With Energy Resources (POWER) ] 


Major Virus Alert 


George Bush Virus —- Doesn’t do anything, but you can’t get rid of it 
until November. 

Ted Kennedy Virus -— Crashes your computer, but denies it ever happened. 

Warren Commission Virus - Won’t allow you to open your files for 75 years 

Jerry Brown Virus —- Blanks your screen and begins flashing an 800 number. 

David Duke Virus - Makes your screen go completely white. 

Congress Virus - Overdraws your disk space. 

Paul Tsongas Virus - Pops up on Dec. 25 and says "I’m Not Santa Claus." 

Pat Buchanan Virus - Shifts all output to the extreme right of the screen. 


Dan Quayle Virus —- Forces your computer to play "PGA TOUR" from 10am to 
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4pm, 6 days a week 


Bill Clinton Virus - This virus mutates from region to region. We’re not 
exactly sure what it does. 

Richard Nixon Virus - Also know as the "Tricky Dick Virus." You can wipe 
it out, but it always makes a comeback. 

H. Ross Perot Virus —- Same as the Jerry Brown virus, only nicer fonts are 


used, and it appears to have had a lot more money put 
into its development. 


AUDIO LINKS 


By Mr. Upsetter 
It all started with my Macintosh... 


Some time ago I had this crazy idea of connecting the output from the audio 
jack of my Macintosh to the phone line. Since the Macintosh has built in sound 
generation hardware, I could synthesize any number of useful sounds and play 
them over the phone. For instance, with a sound editing program like 
SoundEdit, it is easy to synthesize call progress tones, DTMF and MF tones, red 
box, green box, and other signalling tones. So I set out to do exactly this. 

I created a set of synthesized sounds as sound resources using SoundEdit. Then 
I wrote a HyperCard stack for the purpose of playing these sounds. Now all I 
needed was a circuit to match the audio signal from the headphone jack of my 
Mac to the phone line. 


How The Circuit Works 


I designed a simple passive circuit that does the job quite well. Here is the 
schematic diagram. 


TL 
ORES R1 ) fo) ( ) Cl. , ‘Pesos Oa SahS fo) 
+ | = ( ) | 
( ) 
to Mac D D 8 ) 500 VR to 
headphone 1 2 ohm ( ) ohm 1 phone 
jack ( ) lin 
—| + | ( ) 
fe) fe) fe) ( ) fe) fe) 


C1-.22 uF, 200V 

D1,D2- 1N4148 switching diode 

R1-620 ohm, 1/4W 

T1l- 8 ohm to 500 ohm audio transformer, Mouser part 42TLOO1 
VR1-300V MOV, Mouser part 570-V300LA4 


VR1 is a 300V surge protector to guard against transient high voltages. 
Capacitor Cl couples the phone line to transformer Tl, blocking the phone 
line’s DC voltage but allowing the AC audio signal to pass. The transformer 
matches the impedance of the phone line to the impedance of the headphone jack. 
Diodes Dl and D2 provide clipping for additional ringing voltage protection 
(note their polarity markings in the schematic). They will clip any signal 
above 7 volts. Resistor Rl drops the volume of the audio signal from the Mac 
to a reasonable level. The end result is a circuit that isolates the Mac from 
dangerous phone line voltages and provides a good quality audio link to the 
phone line. 


Building and Using the Circut 

This simple circuit is easy to build (if you’re handy with electronics). I 
personally prefer to solder the circuit together. A length of shielded audio 
cable with a 1/8 inch mono plug on one end should be connected to the audio 
input end of the circuit. A standard RJ11l phone jack should be connected to 

the phone lin nd of the circuit. Although this circuit will protect against 
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dangerous phone line voltages, it is best to disconnect it when not in use. 
You just don’t want to risk anything bad happening to your brand new Quadra 
900, right? 


Once you have an audio link between your Mac and the phone line, th 
applications are limitless. Use HyperCard’s built-in DTIMF dialing to dial for 
you, or build a memory dialer stack. Talk to people with Macintalk. Play your 
favorite Ren and Stimpy sounds for your friends. Play a ringback tone to 
"transfer" people to an "extension". Build and use a set of synthesized MF 
tones. Try to trick COCOT’s with synthesized busy and reorder signals. 


But Wait, There Is More... 

So you say you don’t own a Macintosh? That is ok, because the circuit can be 
used with other devices besides your Mac. You can use it with the 8 ohm 
headphone output from tape recorders, radios, scanners, etc. You could also 
probably use it with any other computer as long as you had the proper audio D/A 
hardware and software to create sounds. 


All parts are available from Mouser Electronics. Call 800-346-6873 for a free 
catalog. 


Thank You Disk Jockey! 
Date: May 22, 1992 
From: Sarlo 
To: Phrack 
Subject: The Disk Jockey 


I was searching through some Phracks (issues 30-38), just checking them out and 
noticed something. It’s small and insignificant, I guess, but important to me 
all the same. 


I noticed in Disk Jockey’s Prophile (Phrack 34, File 3) that he "Never got any 
thanks for keeping his mouth shut."..I dunno how to get ahold of him or 
anything, but if you drop a line to him sometime, tell him I said "thanks." 


-Sarlo 


An Upset Reader Responds To Knight Lightning and Phrack 

Date: Mon, 20 Apr 92 16:57 GMT 

From: "Thomas J. Klotzbach" <0003751365@mcimail.com> 

To: Knight Lightning <kl@stormking.com> 

Subject: In response to your comments of Phrack Vol 4, Issue 37, File 2 of 14 


Hi, 


I have a lot of respect for Phrack and all the work they are doing to 
promote an understanding of the Computer Underground. But your comments in the 
latest issue of Phrack are what I would like to comment on. 


You say: 
"In short -- I speak on behalf of the modem community in general, 


"FUCK OFF GEEK!’ Crawl back under the rock from whence you came 
and go straight to hell!" 


First, you don’t speak for me and about five other people at this college. 
I have maintained throughout that the ONLY way to further the efforts of the 
Computer Underground is to destroy them with logic - not with creton-like 
comments. Yes, you are entitled to your say - but why not take this Dale Drew 
person and destroy him with logic? The minute that you descend to the level 
Dale Drew operates from makes you look just as ridiculous as him. 
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In my opinion, you came off very poorly in the exchange with Dale Drew. 


Thomas J. Klotzbach MCI Mail: 375-1365 
Genesee Community College Internet: 3751365@mcimail.com 
Batavia, NY 14020 Work: (716) 343-0055 x358 


Dear Mr. Klotzbach, 
>From all of us at Phrack, this is our reply to your recent email... 


KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK KKK KKK K 


Cyber-Redneck & Shitkickin’ Jim’s 
GUIDE TO MANLY HACKING 


A Lod/GoD Presentation 
Legion of d0oDeZ / Gardeners of Doom! 


"You can have my encryption algorithm, 
when you pry it from my cold dead fingers!" 


KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK KKK KKK KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK 


NOW BOYS... first of all, you gotta git yerself a pickup truck. Shitkickin’ 
Jim’s got one. And you gotta get a bedliner, a toolbox, a gunrack, and a CB. 
For decoration, you have to get a confederate flag Hank Williams Jr. license 
plate, or a Harley Davidson license plate, at your option. You also gotta get 
an NRA sticker for the back, and the Bassmaster fishing sticker (you know, the 
one that’s has a fish on it). The most mandatory requirement are two antennaes 
for your CB which are mounted on each of the side view mirrors. 


Now that you have your pickup truck/hackermobile, you gotta rip out the 
dashboard and mount a Data General processing unit in the front seat, cuz 
that’s a manly-sounding computer name, not some pussy sounding /’puter. You 
also have to get an Anchorman direct-connect modem, cuz that’s the only thing 
left that your battery will be able to power. 


Not only do you have to have a pickup truck, but you gotta have rollbars, with 
Foglights, armed with KC light covers so that you can see at night while you’re 
trashing. 


HE MANLY WAY FOR A NIGHT OF HACKING 


NOTE: Before you begin any journey in the hackmobile, you must get a six pack 
of Budweiser, and a carton of Marlboro reds. It’s mandatory. 


Call up your buddy who owns his own trash business. If you are a real man, ALL 
of your friends will work in this business. Get him to take the company truck 
out (the deluxe model the Hercules trash truck, the one with the forklift on 
the front). 


HOW REAL MEN GO TRASHING 


Drive down to your local Bell office or garage, and empty all of the dumpsters 
into the trashtruck, by way of the convenient forklift. This method has 
brought both me and Shitkickin’ Jim much luck in the way of volume trashing. 


Now that you have all of your trash, go back and dump it in your backyard. If 
you are a real man, no one will notice. Dump it between the two broke down 
Chevette’s, the ones that all the dogs will sleep under, next to the two 
barrels of wire. 


Go through the trash and find out who the geek is that is the switchman at the 
central office. This shouldn’t be hard. It’s the little squiggly letters at 
the bottom of the page. 
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Next, drive to his house. Pull your truck into his front yard. Threaten him 
with the following useful phrase: 


"HAY FAY-GUT! WUT IS THE PASSWORD TO THE LOCAL COSMOS DIALUP?" 


"IFFIN YOU DON’T TELL ME, I’M GONNA RUN OVER YOUR PIECE OF SHIT RICE-BURNING 
COMMUNIST JAPANESE CAR WITH MY 4 BY 4 PICKUP TRUCK, GAWDDAMIT!" 


Then spit a big, brown, long tobaccoe-juice glob onto his shirt, aiming for the 
Bell logo. Should he withhold any information at this point, git out of yer 
truck and walk over to him. Grab him by his pencil neck, and throw him on the 
ground. Place your cowboy boot over his forehead, and tell him your going to 
hogtie his ass to the front of your 4 by 4 and smash him into some concrete 
posts. At this point, he will give in, especially noticing the numerous guns 
in the gunrack. 


WHAT TO DO WITH THE INFORMATION THAT YOU HAVE COVERTLY OBTAINED 


Don’t even think about using a computer. Make him log on to his terminal at 
home, and make him do whatever you like. Read a copy of JUGGS magazine, or 
High Society, or Hustler, while at the same tim xhibiting your mighty hacker 
power. Enjoy the newfound fame and elitism that you will receive from your 
friends and loved ones. GOD BLESS AMERICA! 


KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK KKK KKKK 


This file was brought to you by Cyber-Redneck a/k/a Johnny Rotten, and 
Shitkickin’ Jim a/k/a Dispater. 


Iffin you don’t like this here file, we will burn a cross in your yard, and 
might even tell the BellCo geek to cut your line off. He’s still tied up in 
Shitkickin’ Jim’s basement. 
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==Phrack Inc.== 


Volume Four, Issue Thirty-Nine, File 3 of 13 


==Phrack Pro-Phile== 
Written by Dispater 
Created by Taran King (1986) 
Welcome to Phrack Pro-Phile. Phrack Pro-Phile is created to bring info to 
you, the users, about old or highly important/controversial people. This 
month, I bring to you the one of the earlier hackers to make headlines and 


legal journals due to computer hacking... 


(_>Shadow Hawk 1<_) 


Personal 
Handle: (_>Shadow Hawk 1<_) 
Call me: Herb 
Past handles: Feyd Rautha, Captain Beyond, Mental Cancer 
Handle origin: Stolen from the name of an 8-bit Atari 800 game that 
seemed to be written in the language RGL (anyone got it 
for the IBM? ;-) ). 
Date of Birth: August 6, 1970 
Age at current date: 21 
Height: 6/2" 
Weight: 190 lbs. 
Eye color: Gray 
Hair color: Brown 
Computer: 386/Linux 


I started working with computers in the 6th grade with an Atari 800 and 
a cassette drive. I added a modem and a disk drive and started researching 
other computer systems [checking out other hacker’s conquests ;-) ]. 
Eventually, I decided that UNIX was to be the OS of choice. 


As a child, I was always curious about stuff in my own reality, so 
naturally, when computers became available... 


I first owned an Atari 800, then an Atari ST 1040, followed by a short-— 
lived Unix-PC 3Bl, and a lame 20MHz 386. Currently, I have a 33MHz 386. Most 
of my hacking-type knowledge came from a text file that listed a few Unix 
defaults; I used those to go and learn more on my own. Other OSes, I just 
hacked at random 8-). 


I started out with systems that had already been penetrated and I built up 
my own database of systems from there. I wasn’t too clever in the beginning, 
though, and lost a few systems to perceptive sys-admins. 


I specialized in Unix, though I enjoyed toying with obscure systems 
(RSX-11, Sorbus Realtime Basic, etc.) 


In the hack/phreak world, I used to hang out with The Prophet, The Serpent 
(Chicago), The Warrior, and others for short periods of time, who shall remain 
nameless. 


As far as what were memorable hack/phreak BBSes, I’d have to say none... 
Not that there weren’t any, but I have just forgotten them all. 


My accomplishments in the phreak/hack world include writing a few text 
files, typing in a few books, getting in lots of systems, and learning a bit 
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about the Unix OS. Other than that, absolutely nothing; my life is computers! 
(NOT!) 


I _was_ associated with the J-Men a few years back, but that’s the only 
hack/phreak group that I ever had anything to do with. 


I was busted for overzealousness in penetrating AT&T computer networks and 
systems. I stupidly made calls from my unprotected home phone. I got caught 
trying to snag Unix SysV 3.5 68K kernel source. 


I had already given up the practice of sharing information when I realized 
how quickly systems went away after their numbers and logins were posted 8-). 
After I got busted, I decided it might be best to limit my hacking to those 
strata of reality on which it is not (yet) prohibited to hack ;-) 


A 


In real life, I originally was going to be an EE/CS major in school, but 
now, I’m leaning towards math/modeling/nonlinear dynamics. Work when necessary 
8-|. 


I’m into making music, drawing strange pictures, and exploring the nether 
regions of physical reality. Occasionally I am seen at sci-fi conventions in 
various forms and personages. 


I feel seriously against taking things too seriously. If you can master 
that, you’ve got it all beat! 


(_>Shadow Hawk 1<_)’s Favorite Things 
Work: Nihilist Ontologist. 
Cars: Fast & Loud. 


Foods: I like a little of every cuisine, except those involving large 
amounts of horseradish, beets, raw tomatoes, etc. 
Music: Ecumenical 


Authors: R.A. Wilson is good for kicks; other than that I haven’t read 
much fiction lately. Lots of non-fiction. 

Books: Tlluminatus, Stranger in a Strange Land, Man or Matter, Godel 
Escher and Bach, The Book of the SubGenius. 

Performers: The people at NASA, the U.S. government beings at Washington, 
the nightly news. 

Sex: Yes. 


Most Memorable Experience 


Coming home to a house full of Secret Service, FBI, NSA, DIA, and AT&T agents 
after getting really stoned with some neighborhood friends, and then having 
them take everything electronic that didn’t appear to be a household appliance 
EXCEPT the obviously stolen/dangerous items: a digital power meter, a He-Ne 
laser, and jars of chemicals for making bombs. HUMOR AT ITS FINEST! 


o Thanks to Bill Cook for leaving no stone unturned in my personal life! 

o Thanks to "my" lawyer, Karen Plant, for leaving MANY stones unturned in 
helping to decide my fate! 

o Thanks to the U.S. Federal Justice System for sentencing me to a 9 months 
in a "juvenile facility" (as well as confiscating thousands of dollars of 
stuff, some legal & some not) while allowing burglars, politicians, and 
virus-authors to go free with a slap on the wrist! 

Thanks for Operation Sun-Devil, without which, the venerable Ripco BBS 
would still be in its first incarnation! 


A Few Other Things 

I’d like to thank all the great beings at Lunatic Labs for not removing my 
account while I was sight-seeing in South Dakota. HI! to all my TRUE friends 
(you know who you are) and all the FALSE ones too! Where would I be now 
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without you? Thanks to all those who love me enough to want to control my 
mind. And, of course, THANKS to the hack/phreak community in general for not 
only becoming, as most countercultures do, decadent and passe, but also for 
still bugging me after all these years! 


The Future: well, if reality doesn’t cave itself in TOO badly with all of the 
virtuality that’s on its way, it should be a great time for all to play with 
the "net!" 


Inside jokes: HALOHALOHALOHALOHALOHALOHALOHALOHALOSKSKSKSKSKSKSKSKSKSKSKSKSK 
aerlyeaerlyeaerlyeaerlyeaerlyeaerly... the gwampismobile shall ride again! 


Of the general population of phreaks you have met, would you consider most 
phreaks, if any, to be computer geeks? 


Well, as far as geeking goes, all are free to pursue their interests. It 
is important to remember that social evolution and mental evolution do not 
necessarily occur simultaneously, or instantaneously (usually). 
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==Phrack Inc.== 


Volume Four, Issue Thirty-Nine, File 4 of 13 


Network Miscellany V 
Compiled from Internet Sources 
by Datastream Cowboy 


Network Miscellany created by Taran King 


University of Colorado Netfind Server 


Trying 128.138.243.151 
Connected to bruno.cs.colorado.edu. 
Escape character is ’*]’. 


SunOS UNIX (bruno) 


login: netfind 


Welcome to the University of Colorado Netfind server. 


I think that your terminal can display 24 lines. 
If this is wrong, pleas nter the "Other" menu and 
set the correct number of lines. 


Help/Search/Other/Quit [h/s/o/q]: h 


Given the name of a person on the Internet and a rough description of where 
the person works, Netfind attempts to locate information about the person. 
When prompted, enter a name followed by a set of keywords, such as 


schwartz university colorado boulder 


The name can be a first, last, or login name. The keys describe where th 
person works, by the name of the institution and/or the city/state/country. 


If you know the institution’s domain name (e.g., "cs.colorado.edu", where there 
are host names like "brazil.cs.colorado.edu") you can specify it as keys 


without the dots (e.g., "cs colorado edu"). Keys are case insensitive and may 
be specified in any order. Using more than one key implies the logical AND of 
the keys. Specifying too many keys may cause searches to fail. If this 


happens, try specifying fewer keys, e.g., 
schwartz boulder 


If you specify keys that match many domains, Netfind will list some of the 
matching domains/organizations and ask you to form a more specific search. 

Note that you can use any of the words in the organization strings (in addition 
to the domain components) as keys in future searches. 


Organization lines are gathered from imperfect sources. However, it is usually 
easy to tell when they are incorrect or not fully descriptive. Even if the 
organization line is incorrect/vague, the domain name listed will still work 
properly for searches. Often you can "guess" the proper domain. 


For example, "cs.<whatever>.edu" is usually the computer science department at 
a university, even if the organization line doesn’t make this clear. 


When Netfind runs, it displays a trace of the parallel search progress, along 
with the results of the searches. Since output can scroll by quickly, you 
might want to run it in a window system, or pipe the output through tee(1): 
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rlogin <this server name> -l1 netfind |& tee log 


You can also disable trace output from the "Other" menu. 


You can get the Netfind software by anonymous FTP from ftp.cs.colorado.edu, 
in pub/cs/distribs/netfind. More complete documentation is also available 
in that package. A paper describing the methodology is available in 
pub/cs/techreports/schwartz/RD.Papers/PostScript/White.Pages.ps.Z 
(compressed PostScript) or 
pub/cs/techreports/schwartz/RD.Papers/ASCII/White.Pages.txt.Z (compressed 
ASCII). 


Please send comments/questions to schwartz@cs.colorado.edu. If you would like 
to be added to the netfind-users list (for software updates and other 
discussions, etc.), send mail to: 


net find-users-request@cs.colorado.edu. 


Help/Search/Other/Quit [h/s/o/q]: q 


Exiting Netfind server... 


Connection closed by foreign host. 


Commercial Networks Reachable From The Internet 


By Roman Kanala (kanala@sc2a.unige.ch), CUEPE, University of Geneva 


1. Internet to X.400 


An X.400 address in form 


First name 2 PEE Er 
Surname : Nnnnn 
Organization : Oo000 
ADMD : Aaaaa 
Country “CG 


looks in RFC822 (Internet) addressing like 
/G=Ff£ffFf£/S=Nnnnn/O=00000/@Aaaa.Cec 


or 
ins"/G=Fffff/S=Nnnnn/O=Oo0000/@Aaaa.Cc" 


2. Any X.400 to Internet 


My Internet address 
kanala@sc2a.unige.ch 


can be written for X.400 services (like arCom400 in Switzerland, 
Sprint MAIL or MCI Mail in the USA) as follows: 


C=CH; ADMD=ARCOM; PRMD=SWITCH; O=UNIGE; OU=SC2A; S=KANALA 


and in Internet RFC822 form (althrough I don’t see any reason to do it 
this way for sending messages from Internet to Internet): 


/S=Kanala/OU=sc2a/0=UniGe/P=Switch/@arcom.ch 


3. MCI Mail to Internet (via a gateway) 
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If you are in the USA and using MCI Mail, then you can write to Internet 
addresses as follows: 


TO: Roman Kanala (EMS) 
EMS: INTERNE 
MBX: kanala@sc2a.unige.ch 


The gateway from MCI Mail to Internet is accessed by referencing the user’s 
name as though he were on an EMS service. When EMS name of INTERNET is used 
for example, in the USA, then it’s in order to have NRI (Reston VA) handle the 
message for him. When prompted for mailbox MBX, user enters the Internet 
address he is wanting to send a message to. 


4. Internet to MCI Mail 


The general address form is username@mcimail.com, where the username is in one 
of two forms: either full username or the numerical box number in form of 
digits only and preceded by three zeros, for ex. 0001234567@mcimail.com 
(address 1234567 is ficticious). 


5. AppleLink to Internet or Bitnet 


Internet address is used with a suffix @INTERNET#, like 


kanala@sc2a.unige.ch@internet# 
or kanala@cgeuge52.bitnet@internet# 


(here cgeuge52 is the bitnet address of sc2a.unige.ch) 


6. Internet or Bitnet to AppleLink 


AppleLink address is used as if it were an Internet username on the 
AppleLink.Apple.Com node, like: 


CHO389@applelink.apple.com 


7. CompuServe to Internet 


In the address field from CompuServe, type the symbol >, "greater than", the 
word "INTERNET" in uppercase characters, then a space followed by the Internet 
address, like: 


>INTERNET kanala@sc2a.unige.ch 


8. Internet to CompuServe 


The CompuServe address is used followed by "@compuserve.com". In the 
CompuServe mailbox number the comma is replaces by a period, example: 


12345.678@compuserve.com (address 12345.678 is ficticious) 


Inter-Network Mail Guide 
This document is Copyright 1990 by John J. Chew. All rights reserved. 
Permission for non-commercial distribution is hereby granted, provided 
that this file is distributed intact, including this copyright notice 
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and the version information above. Permission for commercial 
distribution can be obtained by contacting the author as described 
below. 


INTRODUCTION 


This file documents methods of sending mail from one network to another. It 
represents the aggregate knowledge of the readers of comp.mail.misc and many 
contributors elsewhere. If you know of any corrections or additions to this 
file, please read the file format documentation below and then mail to me: 


John J. Chew <poslfit@gpu.utcs.utoronto.ca> 


DISTRIBUTION 


(news) This list is posted monthly to Usenet newsgroups comp.mail.misc and 
news .newusers.questions. 

(mail) I maintain a growing list of subscribers who receive each monthly 
issue by electronic mail, and recommend this to anyone planning to 
redistribute the list on a regular basis. 

(FTP) Internet users can fetch this guide by anonymous FTP as “~ftp/pub/docs/ 
internetwork-mail-guide on Ra.MsState.Edu (130.18.80.10 or 130.18.96.37) 
[Courtesy of Frank W. Peters] 

(Listserv) Bitnet users can fetch this guide from the Listserv at UNMVM. 
Send mail to LISTSERV@UNMVM with blank subject and body consisting of 
the line "GET NETWORK GUIDE". [Courtesy of Art St. George] 


HOW TO USE THIS GUIDE 


Each entry in this file describes how to get from one network to another. To 
keep this file at a reasonable size, methods that can be generated by 
transitivity (A->B and B->C gives A->B->C) are omitted. Entries are sorted 
first by source network and then by destination network. This is what a 
typical entry looks like: 


#F mynet 

#T yournet 

#R youraddress 

#C contact address if any 

#I send to "“youraddress@thegateway" 


For parsing purposes, entries are separated by at least one blank line, and 
each line of an entry begins with a "#" followed by a letter. Lines beginning 
with "#" are comments and need not be parsed. Lines which do not start with a 
"#" at all should be ignored as they are probably mail or news headers. 


#F (from) and #T (to) lines specify source and destination networks. If you’re 
sending me information about a new network, please give me a brief description 
of the network so that I can add it to the list below. The abbreviated network 
[ lines should consist only of the characters a-z, 0-9 


names used in #F and #T 
and "-" unless someone can make a very convincing case for their favourite pi 
character. 


These are the currently known networks with abbreviated names: 


applelink AppleLink (Apple Computer, Inc.’s in-house network) 
bitnet international academic network 

bix Byte Information eXchange: Byte magazine’s commercial BBS 
bmug Berkeley Macintosh Users Group 

compuserve commercial time-sharing service 

connect Connect Professional Information Network (commercial) 
easynet Easynet (DEC’s in-house mail system) 

envoy Envoy-100 (Canadian commercial mail service) 

fax Facsimile document transmission 

fidonet PC-based BBS network 


geonet GeoNet Mailbox Systems (commercial) 
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R 


C 
as 


internet the Internet 

mci MCI’s commercial electronic mail service 

mfenet Magnetic Fusion Energy Network 

nasamail NASA internal electronic mail 

peacenet non-profit mail service 

sinet Schlumberger Information NETwork 

span Space Physics Analysis Network (includes HEPnet) 
sprintmail Sprint’s commercial mail service (formerly Telemail) 
thenet Texas Higher Education Network 


(recipient) gives an example of an address on the destination network, to 


make it clear in subsequent lines what text requires subsitution. 


(contact) gives an address for inquiries concerning the gateway, expressed 
an address reachable from the source (#F) network. Presumably, if you can’t 


get the gateway to work at all, then knowing an unreachable address on another 


network will not be of great help. 


#1 


(instructions) lines, of which there may be several, give verbal 


instructions to a user of the source network to let them send mail to a user on 
the destination network. Text that needs to be typed will appear in double 


quotes, with C-styl scapes if necessary. 

F applelink 

T internet 

R user@domain 

I send to "user@domain@internet#" 

I domain can be be of the form "Site.bitnet", address must be <35 


HHAHHHHHHAD AA 


eS a 


HWH 


HWH*R 


HH DY) HAY 


es ae tat 


characters 


bitnet 

internet 

user@domain 

Methods for sending mail from Bitnet to the Internet vary depending on 
what mail software is running at the Bitnet site in question. In the 
best case, users should simply be able to send mail to "user@domain". 
If this doesn’t work, try "userSdomain@gateway" where "gateway" is a 
regional Bitnet-Internet gateway site. Finally, if neither of these 
works, you may have to try hand-coding an SMTP envelope for your mail. 
If you have questions concerning this rather terse note, please try 
contacting your local postmaster or system administrator first before 
you send me mail -- John Chew <poslfit@gpu.utcs.utoronto.ca> 
compuserve 

fax 

+1 415 555 1212 

send to "FAX 14155551212" (only to U.S.A.) 


compuserve 
internet 

user@domain 

send to ">INTERNET:user@domain" 


compuserve 
mci 
123-4567 

send to ">MCIMAIL:123-4567" 


connect 

internet 

user@domain 

send to CONNECT id "DASNET" 

first line of message: "\"user@domain\"@DASNET" 


easynet 
bitnet 
user@site 
DECWRL: : ADMIN 
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I from VMS use NMAIL to send to "nm%DECWRL::\"user@site.bitnet\"" 
I from Ultrix 

I send to "user@site.bitnet" or if that fails 

I (via IP) send to "\"user%site.bitnet\"@decwrl.dec.com" 

I (via DECNET) send to "DECWRL::\"user@site.bitnet\"" 

F easynet 

T fidonet 

R john smith at 1:2/3.4 

C DECWRL: : ADMIN 

I from VMS use NMAIL to send to 

I "nmSDECWRL::\"Jjohn.smith@p4.f£3.n2.z1.fidonet.org\"" 
#I from Ultrix 

a send to "Jjohn.smith@p4.f3.n2.z1.fidonet.org" or if that fails 
I (via IP) send to 
\"John.smithsp4.£3.n2.z1.fidonet.org\"@decwrl.dec.com" 

I (via DECNET) send to "DECWRL::\"john.smith@p4.f£3.n2.z1.fidonet.org\"" 
F easynet 

T internet 

R user@domain 

C DECWRL: : ADMIN 

I from VMS use NMAIL to send to "nm%DECWRL::\"user@domain\"" 

I from Ultrix 

ag send to "user@domain" or if that fails 

I (via IP) send to "\"user%Sdomain\"@decwrl.dec.com" 

I (via DECNET) send to "DECWRL::\"user@domain\"" 

F envoy 

T internet 

R user@domain 

C ICS.TEST or ICS.BOARD 

I send to "[RFC-822=\"user (a) domain\"] INTERNET/TELEMAIL/US 

I for special characters, use @=(a), !=(b), _=(u), any=(three octal digits) 
F fidonet 
#T internet 

R user@domain 

I send to "uucp" at nearest gateway site 

I first line of message: "To: user@domain" 

F geonet 

T internet 

R user@domain 

I send to "DASNET" 

I subject line: "user@domain! subject" 

F internet 

T applelink 

R user 

I send to "user@applelink.apple.com" 

F internet 

T bitnet 

R user@site 

I send to "user%site.bitnet@gateway" where "gateway" is a gateway host that 
I is on both the internet and bitnet. Some examples of gateways are: 
I cunyvm.cuny.edu mitvma.mit.edu. Check first to see what local policies 
mE are concerning inter-network forwarding. 
#F internet 

T bix 

R user 

I send to "user@dcibix.das.net" 

F internet 

T bmug 

R John Smith 


4.txt Wed Apr 26 09:43:39 2017 7 
I send to "John.Smith@bmug.fidonet.org" 


F internet 

T compuserve 

R 71234,567 

I send to "71234.567@compuserve.com" 

aL note: Compuserve account IDs are pairs of octal numbers. Ordinary 
I consumer CIS user IDs begin with a ‘7’ as shown. 

F internet 

T connect 

R NAME 
#I send to "NAME@dcjcon.das.net" 

F internet 

T easynet 

R HOST: :USER 

C admin@decwrl.dec.com 

I send to "user@host.enet.dec.com" or "user%Shost.enet@decwrl.dec.com" 
F internet 

T easynet 

R John Smith @ABC 

C admin@decwrl.dec.com 

I send to "John.Smith@ABC.MTS.DEC.COM" 

I (This syntax is for All-In-1 users.) 

F internet 

T envoy 

R John Smith (ID=userid) 

C /C=CA/ADMD=TELECOM. CANADA/ID=ICS.TEST/S=TEST_GROUP/@nasamail.nasa.gov 
Cc for second method only 

I send to "uunet.uu.net!att!attmail!mhs!envoy!userid" 

als or to "/C=CA/ADMD=TELECOM.CANADA/DD.ID=userid/PN=John_Smith/@Sprint.CoM" 
F internet 
#T fidonet 

R john smith at 1:2/3.4 

I send to "Jjohn.smith@p4.f3.n2.z1.fidonet.org" 

F internet 

T geonet 

R user at host 

I send to "user:host@map.das.net" 

I American host is geo4, European host is geol. 

F internet 

T mci 

R John Smith (123-4567) 

I send to "1234567@mcimail.com" 

I or send to "JSMITH@mcimail.com" if "JSMITH" is unique 

I or send to "John_Smith@mcimail.com" if "John Smith" is unique - note the 
iE underscore! 

I or send to "John_Smith/1234567@mcimail.com" if "John Smith" is NOT unique 
F internet 

T mfenet 

R user@mfenode 

I send to "user%smfenode.mfenet@nmfecc.arpa" 

#F internet 

T nasamail 

R user 

C <postmaster@ames.arc.nasa.gov> 

I send to "user@nasamail.nasa.gov" 

F internet 


T peacenet 
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R user 
C <support%cdp@arisia.xerox.com> 
I send to "user%Scdp@arisia.xerox.com" 


F internet 

T sinet 

R node::user or nodel::node::user 

I send to "user@node.SINet.SLB.COM" or "user%node@nodel.SINet.SLB.COM" 


F internet 

T span 

R user@host 

#C <NETMGR@nssdca.gsfc.nasa.gov> 

I send to "user@host.span.NASA.gov" 

I or to "usershost.span@ames.arc.nasa.gov" 


F internet 

T sprintmail 

R [userid "John Smith"/organization]system/country 

I send to 
/C=country/ADMD=system/O=organization/PN=John_Smith/DD.ID=userid/@Sprint 


F internet 

T thenet 

R user@host 

I send to "user%Shost.decnet@utadnx.cc.utexas.edu" 


Fo mci 

T internet 

R John Smith <user@domain> 

I at the "To:" prompt type "John Smith (EMS)" 
I at the "EMS:" prompt type "internet" 

IT at the "Mbx:" prompt type "user@domain" 


F nasamail 

T internet 

#R user@domain 

I at the "To:" prompt type "POSTMAN" 

IT at the "Subject:" prompt enter the subject of your message 


I at the "Text:" prompt, i.e. as the first line of your message, 
I enter "To: user@domain" 
F sinet 


T internet 
R user@domain 
I send to "M MATILNOW: :M_INTERNET::\"user@domain\"" 


I or "M MATLNOW: :M_INTERNET::domain::user" 
F span 

T internet 

R user@domain 

C NETMGR@NSSDCA 

I send to "AMES::\"user@domain\"" 


F sprintmail 

T internet 

R user@domain 

I send to "[RFC-822=user(a)domain @GATEWAY] INTERNET/TELEMAIL/US" 


F thenet 

#T internet 

R user@domain 

I send to UTADNX::WINS%" user@domain " 


.COM" 


MUDs 
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Project 


MUDWHO servers (5) 


Name Address Numeric Address Port Status Notes 
Amber amber.ecst.csuchico.edu 132.241.1.43 6889 up 1 
DEC decuac.dec.com 192.5.214.1 6889 up 5 
Littlewood littlewood.math.okstate. 139.78.1.13 6889 up 4 
edu 
Nova nova.tat.physik. 134.2.62.161 6889 up 3 
uni-tuebingen.d 
PernWHO milo.mit.edu 18.70.0.216 6889 up 2 
AberMUDs (11) 
Name Address Numeric Address Port Status Notes 
Aber5@FSU loligo.cc.fsu.edu 128.186.2.99 5000 R* 
DIRT ulrik.uio.no 129.240.2.4 6715 up 32 
Dragon messua.informatik. V3 226.2240.9 6715 up 
rwth-aachen.de 
Eddie aber ddie.ee.vt.edu 128 3173.9: 207 5000 TO 
Alles 
EnchantedMud neptune.calstatela.edu 130.182.193.1 6715 up 22 
Longhorn lisboa.cs.utexas.edu 128.83.139.10 6715 up 
Mustang MUD mustang.dell.com 143.166.224.42 6715 up 
SpudMud stjoe.cs.uidaho.edu 129.101.128.7 6715 up 
Temple bigboy.cis.temple.edu 129:432..32:598 6715 up 
The Underground hal.gnu.ai.mit.edu 128.52.46.11 6715 R* 
Wolf b.cs.wvu.wvnet.edu L2 9 Jd LZ 6715 R* 
DikuMUDs (17) 
Name Address Numeric Address Port Status Notes 
Albanian judy.indstate.edu 139.102.14.10 4000 R 
DikuMUD 
AlexMUD alex.stacken.kth.se 130.237.237.3 4000 up 
*Alfa Diku alfa.me.chalmers.se 129:2.1-65:0.6 21 4000 up 
Austin MUD austin.daimi.aau.dk 130.225.16.161 4000 R 29 
Caltech DIKU eltanin.caltech.edu 131.215.139.53 4000 R 
Copper Diku copper.denver.colorado. 132.194.10.1 4000 up 33 
edu 
Davis Diku fajita.ucdavis.edu 128.120.61.203 3000 up 28 
DikuMUD I bigboy.cis.temple.edu 12:9:.32.32.98 4000 up 
Elof DikuMUD elof.iit.edu 192.41.245.90 4000 up 
Epic hal.gnu.ai.mit.edu 128.52.46.11 9000 R 
Grimne Diku flipper.pvv.unit.no 129.241.36.200 4000 R 
HypeNet 22??? 12:9... 205 42%:2 4000 TO 
Matscil Diku matscil.uncwil.edu 128.109.221.21 4000 up 
Mudde hawk.svl.cdc.com 129.179.4.49 4000 up 
Pathetique 
Sejnet Diku sejnet.sunet.s OD 6362 E2953 4000 up 
Waterdeep shine.princeton.edu 128.112.120.28 4000 up 
Wayne Diku venus.eng.wayne.edu 141.217.24.4 4000 R 
DUMs (2) 
Name Address Numeric Address Port Status Notes 
CanDUM II cheetah.vlsi.waterloo. 129.97.128.253 2001 up 
edu 
DUM II legolas.cs.umu.se 130.239.88.5 2001 R 23 
LPmuds (58) 
Name Address Numeric Address Port Status Notes 
Aegolius vyonous.kennesaw. edu 130:218:..13°.19 2000 up 
Acadicus 
After Hours jJanice.cc.wwu.edu 140.160.240.28 2000 up 30 
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Akropolis 222? 139.124.40.4 6666 up 
Allinite 22??? 134.126.21.223 2222 up 
Bat MUD palikka.jyu.fi 130.234.0.3 2001 up 
*CyberWorld newview.etsu.edu 1922435199233 3000 up 34 
*Darkemud dunix.drake.edu 192.84.11.2 4040 up 26 
Darker Realms worf.tamu.edu 128.194.51.189 2000 up 
Dartmouth LPMud lusty.tamu.edu 128.194.10.118 2000 up 
Deeper Trouble alk.iesd.auc.dk 130.225.48.46 4242 up 
DevMUD huey.cc.utexas.edu 128.83.135.2 9300 R 
DiscWorld II peregrin.resmel.bhp.com. 134.18.1.12 2000 up 
au 
Dragon’s Den eerrard 129.3203: Vie LP 2222 up 
End Of The Line mud.stanford.edu 36.21.0.47 2010 up 35 
Finnegan’s Wake maxheadroom.agps.lanl. 192.12.184.10 2VLZ. - 1p 
gov 
Frontier blish.cc.umanitoba.ca 130.179.168.77 9165 up 
GateWay secum.cs.dal.ca 129°.173:424 31 6969 up 
*Genesis milou.cd.chalmers.se 129.16.79.12 2000 up 36 
*Igor epsilon.me.chalmers.se 129.16:..50:.3.0 1701 up 
ImperialMUD aix.rpi.edu 128.113.426.110 2000 up 37 
Ivory Tower brown-Swiss.macc.wisc. 128.104.30.151 2000 R 27 
edu 
Kobra duteca4.et.tudelft.nl 130.161.144.22 8888 up 
LPSwat aviator.cc.iastate.edu 129.186.140.6 2020 up 
Marches of chema.ucsd.edu 13.2%523.9:.' 68%. 1. 3000 up 
Antan 
Middle-Earth oba.dcs.gla.ac.uk 130.209.240.66 3000 up 38 
Muddog Mud phaedrus.math.ufl.edu 128.227.168.2 2000 up 
Mystic ohm.gmu.edu 129.174.1.33 4000 up 
NANVAENT saddle.ccsun.strath.ac. 130.159.208.54 3000 up 24 
uk 
Nameless complex.is 130.208.165.231 2000 up 
Nanny lysator.liu.se 130.253 6225-4 21. 2000 up 
NeXT 22??? 1526136145 2000 up 
Nemesis dszenger9.informatik. 132.159.2867 2000 up 
tu-muenchen.de 
*Nightfall nova.tat.physik. 134.2.62.161 4242 up 
uni-tuebingen.d 
Nightmare orlith.bates.edu 134.481 5412 2666 R 
Nirvana 4 elof.iit.edu 192.41.245.90 3500 up 
Nuage fifi.univ-lyonl.fr 134.214.100.21 2000 R 
*Overdrive iml.lcs.mit.edu 18:.52<.0.152 519.5 up 
PaderMUD athene.uni-paderborn.de 131.234.2.32 4242 up 
PixieMud elof.iit.edu 192.41.245.90 6969 up 
QUOVADIS disun29.epfl.ch 128 el Be lok] 2345 up 
Realmsmud hammerhead.cs.indiana. 129). 779:.. 207 3.8 2000 up 
edu 
Ringworld 222? 130.199.96.45 3469 R* 34 
Round Table engr71.scu.edu 129.210.16.71 2222 up 
Sky Realms maxheadroom.agps.lanl. 192.12.184.10 2000 R* 
gov 
SmileyMud elof.iit.edu 192.41.245.90 5150 up 
StickMUD palikka.jyu.fi 130.234.0.3 7680 up 
SvenskMUD lysator.liu.se 130.236.254.1 2043 up 39) 
*The Mud dogstar.colorado.edu 128.138.248.32 5555 up 
Institute 
Top Mud lonestar.utsa.edu 129.115 120-24: 2001 up 
Tsunami II gonzo.cc.wwu.edu 140.160.240.20 2777 R* 20 
TubMUD morgen.cs.tu-berlin.de 130.149.19.20 7680 up 
Valhalla wiretap.spies.com 130.43.3.3 2444 up 
Valkyrie Prime fozzie.cc.wwu.edu 140.160.240.21 2777 up 
VikingMUD swix.ifi.unit.no 129.241.163.51 2001 up 
Vincent’s aviator.cc.iastate.edu 129.186.140.6 1991 up 31 
Hollow 
World of Mizar delial.docs.uu.se 130.238.8.40 9000 R 
mage (1) 
Name Address Numeric Address Port Status Notes 
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SynthMAGE synth.erc.clarkson.edu 1:28:21 53:28 235 4242 TO 
MOOs (1) 
Name Address Numeric Address Port Status Notes 
Lambda MOO lambda.parc.xerox.com 13 22%.1762:3-6 8888 up 
TinyMUCKs (12) 
Name Address Numeric Address Port Status Notes 
AfterFive pa.itd.com 128.160.2.249 9999 up 31 
Burning Metal amber.ecst.csuchico.edu 132.241.1.43 8088 up 
Crossroads coyote.cs.wmich.edu 141.218.40.40 5823 R* 
FurryMUCK highlandpark.rest.ri.cmu 128.2.254.5 2323 up 8 
edu 
High Seas opus.calstatela.edu 30.1:825)2041 4301 up 
Lawries MUD cserve.cs.adfa.oz.au 131.236.20.1 4201 R 7 
PythonMUCK zeus.calpoly.edu 129.65.16.21 4201 up 18 
QWest glia.biostr.washington. 128.95.10.115 9999 up 
edu 
Quartz Paradise quartz.rutgers.edu 128.6.60.6 9999 up 40 
Time Traveller betz.biostr.washington. 128.95.10.119 4096 up 
edu 
TinyMUD Classic winner.itd.com 128.160.2.248 2000 R 41 
It 
Visions 1_cae05.icaen.uiowa.edu 128.255.21.25 2001 R 16 
MUGs (1) 
Name Address Numeric Address Port Status Notes 
UglyMUG 22??? 130.88.14.17 4201 up 
TinyMUSEs (5) 
Name Address Numeric Address Port Status Notes 
Fantasia betz.biostr.washington. 128.95.10.119 4201 up 13 
edu 
FantasyMuse case2.cs.usu.edu 129.123.7.19 1701 up 42 
MicroMUSE chezmoto.ai.mit.edu 18.43.0.102 4201 up 6 
Rhostshyl stealth.cit.cornell.edu 128.253.180.15 4201 up 42 
TrekMUSE csgate.uncecs.edu 128.109.201.1 1701 R 42 
TinyMUSHes (15) 
Name Address Numeric Address Port Status Notes 
Dungeon ra.info.sunyit.edu 149.15.1.3 8888 up 
Global MUSH workstation5.colby.edu 137.146.64.237 420 up 
ImageCastle wizard.etsu.edu 1:92.43%.1:99.. 1:9 4201 up 
Narnia nimitz.mit.edu 18.80.0.161 2599). URS 
PernMUSH milo.mit.edu 18.70.0.216 420 up 42 
SouthCon utpapa.ph.utexas.edu 1234.83 .1.31);52 420 up 42 
Spellbound thumper.cc.utexas.edu 128.83.135.23 4201 up 
SqueaMUSH ultimo.socs.uts.edu.au 138.25.8.7 6699 R** 
StingMUSH newview.etsu.edu 192.43.199.33 1701 up 42 
TinyCWRU caisr2.caisr.cwru.edu 129223924222 420 R* 
TinyHORNS louie.cc.utexas.edu 128.83.135.4 420 up 
TinyTIM II cheetah.ece.clarkson. 128.153213.54 5440 up 
edu 
VisionMUSH tramp.cc.utexas.edu 128.83.135.26 4567 TO 
TeenyMUDs (3) 
Name Address Numeric Address Port Status Notes 
ApexMUD apex.yorku.ca 130.63.7.6 4201 up 
Evil !MUD fido.econ.arizona.edu 128.196.196.1 4201 up 
Met roMUT uokmax.ecn.uoknor.edu 129.15.20.2 5000 R 
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TinyMUDs (2) 
Name Address Numeric Address Port Status Notes 
DragonMUD ghost.cse.nau.edu 134.114.64.6 4201 up 14 
TinyWORLD rillonia.ssc.gov 143.202.16.13 6250 up 
UnterMUDs (9) 
Name Address Numeric Address Port Status Notes 
ChrisMUD hawkwind.utcs.utoronto. 128.100.102.51 6600 up 10 
ca 
DECmud decuac.dec.com 1925. 214.7 6565 up LS 
DreamScape moebius.math.okstate. 139.78.10.3 6250 up 11 
edu 
Islandia hawkwind.utcs.utoronto. 128.100.102.51 2323 up 
ca 
RealWorld cook.brunel.ac.uk 134.83.128.246 4201 up 17 
Sludge unixl.cc.ysu.edu 192.55.234.50 6565 up 19 
Sunmark moebius.math.okstate. 139.78.10.3 6543 up 
edu 
WanderLand sun.ca 19275. 1.951 6666 up 9 
WireHED amber.ecst.csuchico.edu 132.241.1.43 6565 up 12 
YAMUDs (1) 
Name Address Numeric Address Port Status Notes 
GooLand toby.cis.uoguelph.ca 131.104.48.112 6715 up 
Notes 
Asterisk (*) before the name indicates that this sites entry was modified in 


the last 7 days. 


Status field: 

* = last successful connection was more than 7 days ago 
= last successful connection was more than 30 days ago 
no successful connection on record 

connection refused 

connection timed out 

host down or unreachable 

network down or unreachable 

= insufficient address information available 


HE 
ll 


Zoo 
OUD 
Noll 


is warlock@ecst.csuchico.edu 

is jtlo@andrew.cmu.edu 

is gamesmgr@taurus.tat.physik.uni-tuebingen.d 

is jJds@math.okstate.edu 

is mjr@decuac.dec.com 
micromuse-registration@michael.ai.mit.edu to register 
Lawrie.Brown@adfa.oz.au to register 
ss7m@andrew.cmu.edu to register 
wanderland@lilith.ebay.sun.com to register 
cks@hawkwind.utcs.toronto.edu to register 
jds@math.okstate.edu to register 
warlock@ecst.csuchico.edu to register 
fantasia@betz.biostr.washington.edu to register 

{jjt, jopsy}@naucse.cse.nau.edu to register 
mjr@decuac.dec.com to register 
schlake@minos.nmt.edu to register 
ee89psw@brunel.ac.uk to register 
send to {awozniak,claudius}@zeus.calpoly.edu to register 
send to mud@cc.ysu.edu to register 
hours 0000-1600 (M) 0100-1700 (TWRE) 0100-2400 (S) 
hours 1700-0800 (MTWRF) O0000-2400(SU) CST 
hours 1900-0600 (MTWRF) O0000-2400(SU) PDT 
hours 1900-0700 (MTWRF) 0000-2400 
M 
M 


administrator 
administrator 
administrator 
administrator 
administrator 
send mail to 
send mail to 
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INTRODUCTION: 


With the plethora of on-line databases in the public and private sectors, 
I feel it is becoming increasingly important to penetrate and maintain access 
to these databases. The databases in question contain data pertaining to our 
personal lives and to our environment, not to mention the tetrabytes of useful 
information that can be directed toward research and personal education. 


Who or What is DIALOG? 


The DIALOG Information Network is a service that links various public and 
commercial databases together for convenience. In the past, when one wanted to 
access LEGAL RESOURCE INDEX, for instance, one would have to dial direct. With 
DIALOG, hundreds of databases are connected via X.25 networks (Tymnet, 
Sprintnet, Uninet, Dialnet) eliminating frustrating searching and outrageous 
long distance telephone bills (before the AT&T divestiture). 


Further, within this file is a PARTIAL list of databases found on-line. 
Some of the databases are nothing more than periodicals and abstract sources, 
while others provide FullText articles and books. There are over 2500 
periodicals, newspapers, newsletters and newswires on-line in FullText. 


Here are a few of my favorites: 


McGraw-Hill Publications On-Line (File624) 


Services offer FullText of their Newsletters serving the world-wide 
aerospace and defense industry. Complete text from 30 newsletters such as 
AeroSpace Daily, BYTE, Aviation Week and Space Technology, Data Communications, 
ENR, among others. For more info on the database, when in DIALOG type Help 
News624. 


PR NEWSWIRE (File613) 


PR Newswire records contain the complete text of news releases prepared 
by: companies; public relations agencies; trade associations; city, state, 
federal and non-US Government agencies; and other sources covering the entire 
spectrum of news. The complete text of a news release typically contains 
details or background information that is not published in newspapers. More 
than 8500 companies contribute news for PR Newswire. PR NEWSWIRE is a known 
agent of Corporate Intelligenc 


DMS/FI MARKET INTELLIGENCE REPORTS (File589) 


— FullText of World AeroSpace Weekly, covers all aspects of both civil and 
military aerospace activities worldwide. 

— World Weapons Review, very high degree of technical detail and 
perspective. As such, it has special appeal to military professionals 
and users of weapons. 
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Note: The database treats the newsletters as separate Binders. For example, 
to access the World Weapons Review, after connecting to the database, 
type: 


SELECT BN=WORLD WEAPONS REVIEW 
or whichever newsletter you wish to search. 


FINE CHEMICALS DATABASE (File360) 


- The focus of this database is on sources for laboratory, specialty, and 
unusual chemicals used in scientific research and new product development. 
Fine chemicals are relatively pure chemicals typically produced in small 


quantities. The database will provide you with manufacturers and/or 
distributors. 
DUN’S ELECTRONIC YELLOW PAGES (File515) 


—- Largest database of U.S. businesses available on DIALOG, providing 


information on a total of 8.5 million establishments. Corporate intelligenc 
you can quickly verify the existence of a business. Then you can obtain 
address, telephone number, employ size, Standard Industrial Classification 


(SIC) and other basic information. 


CURRENT CONTENTS SEARCH (File440) 


—- FullText articles from over 8000+ worldwide journals dealing with 
science and technology. 


BOOKS IN PRINT (File470) 


- Access to in-print and out-of-print books since 1979, BIP lets you 
retrieve bibliographic data on virtually every book published or distributed in 
the United States. Plus FullText reviews on the book(s) you have selected. 

See next. 


PUBLISHERS DISTRIBUTORS AND WHOLESALERS ON-LINE (File450) 


— PDW on-line will locate virtually any book, audio cassette, software 
publisher, distributor, or wholesaler in the U.S. 


You now should have an idea of the power and scope of the Dialog 
Information Network. 


NOTE: Most of DIALOG’s Services are now available to certain Research 
facilities, public and private, on CD-ROM. Check your local public and 
university libraries for this service. Of course, MANY of the more 
interesting databases are not available on CD-ROM and must still be 
accessed through the DIALOG network. 


Access to DIALOG Services 


The following on-line services are available from DIALOG Information 
Services: 


DIALOG 

DIALOG Business (DBC) 

DIALOG Medical Connection (DMC) 
DIALMATL 

KNOWLEDGE INDEX 


The logon procedures for the first four are identical and use the same 
service address; procedures for KNOWLEDGE INDEX differ only in the use of the 
KI service address, as illustrated throughout this file. 


The most common method of access to DIALOG services uses local phone 
numbers for three telecommunication networks: DIALOG’s DIALNET, BT Tymnet, 
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TYMNET, and SprintNet. For those who 
for those three networks, you may use 
to all DIALOG services except KNOWLED 
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live in an area that lacks a local dialup 
the 800 link into the DIALNET for access 
GE INDEX. This access is not free, but it 


may cost less than dialing long-dista 
a region without local access. Acces 
other on-line systems. 


Access to many DIALOG services i 


nce to reach a network node if you live in 
s is also available through gateways from 


Ss available from countries throughout the 


world and may be accessed from their 


linet 800-Number Access 


Dia 


The two DIALNET 800 numbers are avail 
from anywhere in the 48 contiguous st 
free. 


(800) DIALNET 
(800) 342-5638 


300, 1200, and 


own Public Data Networks. 


able for connecting to Dialog services 
ates. Access through these numbers is not 


2400 b. (w/MNP error checking) 


(800) 847-1620 VADIC 3400 series modems (1200 baud) 
BEL 103 modems (300 baud) 
BELL 212 modems (1200 baud) 

Note: I have excluded all the dialup numbers for Tymnet and Sprintnet. If you 
don’t know how to find those, obtain a file on X.25 nets and I’m sure 
they will be listed somewhere in them. 

DIALNET U.S. DIALUP NUMBERS 
(All DIALNET dialup numbers support 300, 1200, and 2400 baud) 
ARIZONA 
PH OST Kee etd Gl Se WR soe ne ees eed ws Wale BYR, Se ot SP valet (602) 257-8895 
CALIFORNIA 
ATRAMb Tats bast eee ob ee 8 wid hie eb ee Be ee (818) 300-9000 
THOM GIS SIAC AG ENS, cane Vomteiss a: Selene coeeics Ge nee soeslis, Bed oonetetlts (213) 491-0803 
HOS: ANGSLSS ire ei a, Sine Bedks, oid tnd sees) ar Sees Sh es we SRS (818) 300-9000 
Marina Del Rey... .. eee ee eee ee eee ee ees (213) 305-9833 
NEWPOTE -BEa CH ese csts find Brees BMS teres ores PS ese eee eS Sat (714) 756-1969 
OSHA's sins: Sensoces OSiee Sti seg: istite: a ant seine rah ah ites By Si teiw rea Wats (415) 633-7900 
Pat On ALR Ores J daeane else, oie dls: Sue Cseae ete le wha eee Goede 4 (415) 858-2461 
Piel OAL WON sie ties a. oct teas Shera clergss Riedy ene lebuug aoeere wees (415) 858-2461 
Pratio* AIM Oss iieig erate lenis. pest. BS o Stee de. bg eee Spee, Behe eee oes (415) 858-2575 
SACK AMEN EO rere hee ied oct A eeher eng ceca SS ee Be ce oat Sua eer aes (916) 444-5030 
Sat DPS Oo se econo es tied pode Su gele tide Se wee dee dete dene elel ees (619) 297-8610 
Sal PLANS LS CO ve Fes tesin bare eed Malet o Bene Sees ees bee eee aes (415) 957-5910 
Sail JOSS: dis <.doave FAS G. Bir dee eaten ee aes eetue Ge: bler ewer ent (408) 432-0590 
COLORADO 
VB Xe = oa ee eee ee eT ea (303) 860-9800 
CONNECTICUT 
Bloomtveld/ Hartford 14 sie fee o Odeo we es (203) 242-5954 
Stambor denice. bee Se ehise e S oe evi BO Se. Siar (203) 324-1201 
DELAWARE 
Wa En gQPO Rie sae oe ed Slane secs wees each Dene alec (302) 652-1706 


DISTRICT OF COLUMBIA 
Washingtotts. siir8 o5e.0 Wise sedhe is Bs ROPERS ais en wi ae 


GEORGIA 
Atlantean sicire al-8 2 Spe a lene aitatte sided a kph ee eee acecess 


ILLINOIS 
SA: CAC Os. seeccid. oa! hi eior adie Se geal Oar aha seucat Sele olen GrSsacs! ghat eMetrics 


(703) 359-2500 


(404) 455-4221 


(312) 341-1444 
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INDIANA 
Indianapolis 


MARYLAND 
Baltimore 


MASSACHUSETTS 


ICHIGAN 
Ann Arbor 
Detroit 


INNESOTA 
Minneapolis 


MISSOURI 
st. 


NEW JERSEY 
Lyndhurst 
Morristown 
Newark 
Piscataway 
Princeton 


N 
A 


EW MEXICO 
lbuquerque 


NEW YORK 
Al 


Hempstead 
New York City 
Rochester 


NORTH CAROLINA 
Research Triangle 


OHIO 
Cincinnati 
Cleveland 
Columbus 


OREGON 
rtland 


Ae) 
12) 


PENNSYLVANIA 
Allentown 
Philadelphia 
Pittsburg 
Valley Forge/Norristown 


TEXAS 
Austin 
Dallas 


UTAH 
Sale’ hake? Gre yee kee ce. Biers enehs aeton ark. wo S.hrs. bot eceweaalss 
VIRGINIA 

Fairfax 


(317) 635-7259 


(301) 234-0940 


(201 
(201 
(201 
(201 
(609 


17) 439-7920 
17) 862-6240 


13) 973-2622 
13) 964-1309 


12) 338-0676 


14) 731-0122 


) 460-8868 
) 292-9646 
) 824-1412 
) 562-9680 
) 243-9550 


(505) 764-9281 


) 458-8710 
) 896-9440 
) 489-6868 
) 422-0410 
) 458-7300 
) 328-7810 


19) 549-9290 


489-3980 
621-3807 
461-8348 


3 
16 
4 
3 


LS) 
LS) 
12) 
LS) 


ee ee 


898-8878 


776-2030 
923-5214 
471-1421 
666-1500 


12) 462-9494 
14) 631-9861 
13) 531-0505 


(801) 532-3071 


(703) 359-2500 
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WASHINGTON 
Sai EL Sic nF nop ate oe Re anes Geo cas Bie BeMiey' aie AL eae eee ra BW as (206) 282-5009 
WISCONSIN 
Mil WAUKE Ss Jo. ahaiave o-Sus ca. Reine vie ely ba -a's wore woed. Bhar Me. onal (414) 796-1785 


Access to Dialog Outside of the US 


Foreign readers may access Dialog via the INFONET PDN. The following 
numbers are for those particular users. 


BELGIUM 
Brussels! (300). 5 2n5 kw duds ee els boda ee 6 ded ees (02) 648-0710 
Beusseds: (I200) 2's Se beset gent Sewers eee 8 eee oe (02) 640-4993 
DENMARK 
Copenhagen: '(3:0.0): sesics wate sete bie he oo teins Seles eles (01) 22-10-66 
Copenhagen (1.200) ccs Sai. we te eee eel ee we ae i (01) 22-41-22 


Logging in to DIALOG or KNOWLEDGE INDEX (KI) 


After dialing the appropriate number and establishing the connection, 


must allow a 10-second delay and then enter the letter A (or a carriage return 


or another terminal identifier from the table below) before any further 


response will occur. Then, follow the remainder of the procedures show below. 


DIALOG Information Services’ DIALNET 
=—2151-:01-0:12- 
Enter Service: dialog Enter DIALOG or KI; 


DIALNET: call connected 

DIALOG INFORMATION SERVICES 

PLEASE LOGON: 

?2?XXXXXXXX Enter User Number 


ENTER PASSWORD: 
2?XXXXXXXX Enter Password; 


NOTE: I have researched the method of user number and password distribution 


and all user numbers and passwords are generated by Dialog, BUT upon 
receiving a password from DIALOG you may opt to change it. The 
passwords issued from DIALOG are 8 digits long, consisting of random 
alpha-numeric characters. 


DIALNET Terminal Identifiers 


Speed Identifier Terminal Type Effect 
300 bps ENTER key PCs & CRTs Same as A 
E Thermal Printers Slower 
€ Impact Printers Slowest 
G Belt Printer Slower 
1200 bps ENTER key PCs & CRTs Same as A 
or G Matrix Printers Slower 
2400 bps I Belt Printers Slowest 
—- For access in half duplex, enter a < CTRL H > after the "Enter Service:" 


prompt and before entering the word "dialog" or "ki." 


- Don’t hit backspace if you make an error in typing "dialog" or "ki." The 


Once you are connected to your default service or file in DIALOG, you can then 
BEGIN one of the other services; for example, to access DIALMAIL, BEGIN MAIL. 


result will be toggling your duplex, reason being your backspace is usually 


configured to send a < CTRL H > to delete to the left of the cursor one 
space. 


.txt 
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DIALNET Messages 


Message Probable Cause User Action 

ERROR, RE-ENTER SERVICE Incorrect host name Check typing 

ALL PORTS BUSY All DIALOG ports Try in a few min. 
are temporarily in 
use. 

HOST DOWN DIALOG computer is Try in a few min. 
not available. 

HOST NOT RESPONDING DIALOG Computer Try in a few min. 
difficulty 

CIRCUITS BUSY DIALNET Network is Try in a few min. 
temporarily busy. 

DIALNET: CALL CLEARED Appears after LOGOFF 

BY REQUEST to indicate connection 

ENTER SERVICE: to DIALOG is broken. 

DROPPED BY HOST SYSTEM Indicates a system failure 
at DIALOG. 


To begin a search, 


xxxx would be 
assigned fil 


Navigating in DIALOG 


one would enter: 


BEGIN xxxx 
the database file number. 
numbers. The searching protocol 


at times to be a language in itself, 


but it ca 


All databases found on DIALOG are 


used to manipulate DIALOG seems 
n be easily learned and mastered. 


DIALOG HOM 


EBASE 


I would advise the first-timer to jump into the DIALOG Homebase Menu, 


which provides information, 


the DIALINDEX, 


subscribers wit 
You can 


codes. 


help, 
DIALOG Training, 


file of the month, database info and rates, 
and announcements. 


DIALOG also provides 


he DIALOG HOMBASE 


begin t 


BEGIN HOME 


h special services which include dialouts for certain area 
by typing: 


SOK KKK KKK KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKAKKKAKK KKK 


File Number 
15 
180 
43 
108 
10,110 
9 
38 
236 
258,259 
45 
112 
116 


DIALOG DATABAS 


GJ 


Database 
ABI/INFORM 
Academic American 
ADTRACT 

Aerospace Database 
AGRICOLA 

AIM/ARM 
America:History & Life 

American Men & Women of Science 
AP NEWS 

APTIC 

Aquaculture 

Aqualine 


Encyclopedia 
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44 Aquatic Science & Fisheries ABS 
56 Art Bibliographies, Modern 
192 Arthur D. Little On-Line 
102 ASI 
285 BIOBUSINESS 
287,288 Biography Master Index 
Dy OD: 
295 BIOSIS Previews 
LT BLS Consumer Price Index 
178 BLS Employment, Hours, and Earnings 
176 BLS Producer Price Index 
3 'F Book Review Index 
470 Books In Print 
256 Business Software Database 
308-311 
320 CA Search 
50 CAB Abstracts 
262 Canadian Business and Current Affairs 
162 Career Placement Registry/ Experienced Personnel 
163 Career Placement Reg/Student 
580 CENDATA 
138 Chemical Exposure 
19 Chemical Industry Notes 
174 Chem Regulations & Guidelines 
300,301 CHEMNAME, CHEMSIS 
328-33: CHEMZERO 
30 CHEMSEARCH 
64 Chile Abuse & Neglect 
410 Chronolog Newsletter-International Edition 
101 Compuserve Information Service 
220-222 CLAIMS Citation 
124 CLAIMS Class 
242 CLAIMS Compound Registry 
233254,125. 
223-225 CLAIMS US Patents 
123 CLAIMS Reassignment & Re-examination 
219 Clinical Abstracts 
164 Coffeeline 
194-195 Commerce Business Daily 
593 Compare Products 
8 Compendex 
275 The Computer Database 
77 Conference Papers Index 
135 Congressional Record Abstracts 
271 Consumer Drug Info Fulltext 
171 Criminal Justice Period Index 
60 CRIS/USDA 
230 DATABASE OF DATABASES 
516 D&B - Dun’s Market Identifiers 
517 D&B — Million Dollar Directory 
518 D&B - International Dun’s Market Identifiers 
411 DIALINDEX 
200 DIALOG PUBLICATIONS 
100 Disclosure II 
540 Disclosure Spectrum Ownership 
35 Dissertation Abstracts On-Line 
103,104 DOE Energy 
575 Donnelley Demographics 
229 Drug Information Fulltext 
139 Economic Literature Index 
165 Ei Engineering Meetings 
241 Electric Power Database 
511 Electronic Dictionary of Education 
507 Construction Directory 
501 Financial Services Directory 
510 Manufactures Directory 
502 Professionals Directory 
504-506 Retailers Directory 
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508,509 Services Directory 
503 Wholesalers Directory 
500 Electronic Yellow Pages Index 
72, 73 EMBASE (Excerpta Medica) 
172,173 EMBASE 
114 Encyclopedia of Associations 
69 Energyline 
169 Energynet 
40 ENVIROLINE 
68 Environmental Bibliography 
1 eric 
54 Exceptional Child Education Resources 
29. Family Resources 
20 Federal Index 
136 Federal Register Abstracts 
265 Federal Research in Progress 
196 Find/SVP Reports and studies Index 
268 FINIS: Financial Industry Information Service 
96 Fluidex 
51 Food Science & Technology Abstracts 
79 Foods Adlibra 
90 Foreign Trade & Econ Abstracts 
105 Foreign Traders Index 
26 Foundation Directory 
27 Foundation Grants Index 
58 Geoarchive 
89 Georef 
66 GPO Monthly Catalog 
166 GPO Publications Reference Fil 
85 Grants 
122 Harvard Business Review 
151 Health Planning And Administration 
39 Historical Abstracts 
561 ICC British Company Directory 
562 IcC British Financial Datasheets 
189 Industry Data Sources 
202 Information Science Abstracts 
12, 13 INSPEC 
168 Insurance Abstracts 
209 International Listing Service 
74 International Pharmaceutical Abstracts 
545 Investext 
284 IRS TAXiNFO 
14 ITSMEC 
244 LABORLAW 
36 Language & Language Behavior Abstracts 
426-427 LC MARC 
150 Legal Resource Index 
76 Life Sciences Collection 
61 LISA 
647 Magazine ASAP 
47 Magazine Index 
75 Management Contents 
234 Marquis Who’s Who 
235 Marquis Pro-files 
239 Mathfile 
546 Media General Database 
152-154 MEDLINE 
86 Mental Health Abstracts 
232 Menu The International Software Database 
32 METADEX 
29 Meteor/Geoastrophysical Abstracts 
233 Microcomputer Index 
32 MERADEX 
29 Meteor/Geoastrophysical Abstracts 
233 Microcomputer Index 
248 The Middle East: Abstracts and Index 
249 Mideast File 
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71 MLA Bibliography 
Byero) Moody’s Corporate Profiles 
myo Moody’s Corporate News-International 
556 Moody’s Corporate News - U.S. 
78 National Foundations 
111 National Newspaper News US 
27 NCJRS 
211 Newsearch 
46 NICEM 
70 NICSEM/NIMIS 
118 Nonferrous Metals Abstracts 
6 NTIS 
218 Nursing & Allied Health 
161 Occupational Safety and Health 
28 Oceanic Abstracts 
170 ON-LINE Chronicle 
ZL ONTAP ABI /INFORM 
205 ONTAP BIOSIS Previews 
204 ONTAP CA SEARCH 
250 ONTAP CAB Abstracts 
231 ONTAP Chemname 
208 ONTAP Compendex 
290 ONTAP DIALINDEX 
201 ONTAP ERIC 
272 ONTAP Embase 
213 ONTAP Inspec 
247 ONTAP Magazine Index 
254 ONTAP Medline 
216 ONTAP PTS Promt 
294 ONTAP Scisearch 
207 ONTAP Social Scisearch 
296 ONTAP Trademarkscan 
280 ONTAP World Patents Index 
49 PAIS International 
240 Paperchem 
243 PATLAW 
257 P/E News 
241 Peterson’s College Database 
42 Pharmaceutical News Index 
a7. Philosopher’s Index 
41 Pollution Abstracts 
91 Population Bibliography 
140 PSyYCALERT 
11 PsycINFO 
17 PTS Annual Reports Abstracts 
80 PTS Defense Markets and Technology 
18 PTS F&S Indexes 80- 
98 PTS F&S Indexes 72-79 
81, 83 PTS Forecasts 
570 PTS MARS 
16 PTS PROMPT 
82, 84 PTS TIME SERIES 
190 Religion Index 
421-425 TEMARC 
97 Rilm Abstracts 
34, 87 SciSearch 
94, 186 SciSearch 
7 Social Scisearch 
270 Soviet Science and Technology 
37 Sociological Abstracts 
62 SPIN 
65 SSIE Current Research 
132 Standard & Poor’s News 
£33 Standard & Poor’s Corporate Descriptions 
526 Standard & Poor’s Register-Biographical 
527 Standard & Poor’s Register-Corporate 
113 Standards & Specifications 


238 Telgen 
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119 Textile Technology Digest 
935. Thomas Tegister On-Lin 
648 Trade & Industry ASAP 
148 Trade & Industry Index 
106,107 Trade Opportunities 
226 Trademarkscan 
531 Trinet Establishment Database 
532 Trinet Company Database 
63 TRIS 
52: TSCA Initial Inventory 
480 Ulrich’s International Periodicals Directory 
260,261 UPI NEWS 
126 U.S. Exports 
93 U.S. Political Science Documents 
120 U.S. Public School Directory 
184 Washington Post Index 
117 Water Resources Abstracts 
$50,351 World Patents Index 
67 World Textiles 
185 Zoological Record 


Before I continue describing th 
an on-line master index to the DIALO 
collection of the file indexes of mo 
cannot be searched in DIALINDEX). D 
number of relevant records for a sin 
query can be a single term, a multip 
full logical expression of up to 240 
operators, and truncated terms may a 


You can set the files you want 
Like this: 
B 


EGIN 411 (return) 


S) 


G 


ET FILE 
or 
SF ALLNEWS 


ALLN 


EWS (if y 


hack 


SET FILI 


To scan all Subjects: ES 


ALL 


e various methods of searching, DIALOG has 
G databases, DIALINDEX (file 411). It is a 
st DIALOG databases (menu-driven databases 
IALINDEX can be used to determine the 
gle query in a collection of files. 
le-word phrase, a prefix-coded field, 
characters. Nested terminology, 
lso be used. 


The 
ora 
proximity 


G 


ET FILE 


searched by using the S command. 


ou want the latest news on 
/phreak busts) 


[To scan specific categories: 
All Science: 


(AL 


A 
= ¢ 
Cc 


SCIENCE) 

griculture & Nutrition 
hemistry 

omputer Technology 
Energy & Environment 
Medicine & Biosciences 
Patents & Trademarks 


All Business: 


All News and Current Events: 


All Law & Government: 


Al] 


Social Science & Humanities: 


All General Interest: 


All Reference: (A 


(AL 


Science & technology 
sLBUSINESS) 

usiness Information 
ompany Information 
ndustry Analysis 
ews 

atents & Trademarks 
.LNEWS) 

News 

iL LAW; ALLGOVERNM 
Law & Government 
Patents & Trademarks 
sLSOCIAL; ALLHUMANITIES) 
Social Sciences & Humanities 
GENERAL) 

Popular Information 
LLREFERENCE) 

Books 


B 
c 
I 
N 
P 


ENT) 
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- Reference 
All Text: (ALLTEXT) 

All databases containing 
complete text of: 
- Journal Articles 
— Encyclopedias 
— Newspapers 
— Newswires 

All Sources: (ALLSOURCE) 
-— Complete Text 
— Directory 
— Numeric Data 


All ONTAP Training Files: (ALLONTAPS) 


—- All On-Line Training And 
Practice databases 


Once you have selected a database you can now SELECT the search keyword. 


AN 


Note: 


S 


S 


S) 


- This 


SELECT term Retrieves a set of records containing the term. 


May be used with words, prefix or suffix codes, EXPAND, or 
set numbers. 


defining what you are searching for you can use logical operators 


puts the retrieval of all search terms into one set, eliminating 
duplicate records. 


NOT - 


retrieves the intersection, or overlap, of the search terms: all 
terms must be in each record retrieved. 


eliminates search term (or group of search terms) following it from 
other search term(s). 


Always enter a space on either side of a logical operator. 


ECT Examples: 


[7] 


ECT (BICMOS OR CMOS) AND SRAM 


or 


(BICMOS OR CMOS) AND SRAM 


would generate something like this: 


138 BICMOS <- records containing BICMOS only 
1378 CMOS <- records containing CMOS only 
681 SRAM <- records containing SRAM only 


Sl 203 (BICMOS OR CMOS) AND SRAM <- this is what you 
oNaS wanted. 
|| DIALOG names your select topic Sl, S2... respectively as search its 
databases to make it easier to type. The contents of Sl are 203 
found records containing the keywords BICMOS, CMOS, and SRAM. 
Sometimes Sl is referred to as S(tep) 1 
PROXIMITY OPERATORS (Select command) 
(W) Requests terms be adjacent to each other and in order 
specified. —> S SOLAR (W) ENERGY 
(nW) Requests terms be within (n) words of each other and in order 
specified. —> S SOLAR (3W) ENERGY 
(N) Requests terms be adjacent but in any order. Useful for 
retrieving identical terms. —-> S SOLAR (N) ENERGY 
(nN) Requests terms be within (n) words of each other and in any 
order. -> S SOLAR (3N) ENERGY 
(F) Requests terms be in same field of same record, in any order. 
-> S SOLAR (F) ENERGY 
(L) Requests terms be in same descriptor unit as defined by 
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database. -> S SO 
(S) Requests terms be in same Subfield u 
database. -> S SO 

(C) Equivalent to logic operator AND. 
-> S SO 


PRIORITY OF EXECUTION 


Proximity operator, NOT, AN 


12 
.AR (L) ENERGY 
nit as defined by 
,AR (S) ENERGY 
,AR (C) ENERGY 
D, OR 


Use parentheses to specify different order of execution, e.g. 


SUN) AND (EN 


5 


STOP WORDS (predefined) 


The following words may not be SELECTed as individual terms. 


‘-RGY OR HEAT). Terms within parentheses ar 


SEI 


ECT 


(SOLAR OR 


xecuted first. 


The computer will 


retrieve a set with zero results. They may only be replaced with proximity 


operators, e.g. S GONE (2W) WIND 


AN FOR HE 
AND FROM TO 
BY OF WIT 


RESERVED WORDS AND SYMBOLS 


H 


The following words and symbols must be enclosed in quotation marks whenever 
they are SELECTed as or within search terms, e.g., SELECT "OR" (W) GATE? 

AND = 

FROM i 

NOT + 

OR 

STEPS / 
TRUNCATION 
OPEN: any number of characters following stem. 

SS EMPLOY? 

RESTRICTED: only one additional character following stem. 


number of question marks ent 


character per question mark. 


BASIC INDEX FIELD SPECIFICATION (SUFFIX C 


RESTRICTED: maximum number of additional characters equal to 


ered. 


INTERNAL: allows character replaced by question mark to vary. 


ODES) 


SS HORSE? 


SS UNIVERS?? 


SS WOM?N 


Suffix codes are used to restrict retrieval to specified basic index fields of 
a record. Specific fields and codes vary according to the database. 


Abstract 

Descriptor 

Full Descriptor(single word) 
Identifier 
Full Identifier(single word) 
Title 

Note 

Section Heading 


Examples: 


SELECT BUDGET?/TI 
SELECT POP (W) TOP (W) CAN?/TI,AB 
SELECT (DOLPHIN? OR PORPOISE?) /DE/ID 


= 
ry 
= 
ry 


/BB 
/DE 
/DF 
/ID 
/IF 
/TI 
/NT 
/SH 
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ADDITIONAL INDEXES (PREFIX CODES) 


Prefix codes are used to search additional indexes. Specific fields and codes 
vary according to the database. 


Author AU= 
Company Name CO= 
Corporate Source CS= 
Document Type DT= 
Journal Name JN= 
Language LA= 
Publication Year PY= 
Update UD= 
Examples: 


SELECT AU=JOHNSON, ROBERT? 
SELE LA=GERMAN 
SELECT CS= (MILAN (F) ITALY) 


RANGE SEARCHING 


A colon is used to indicate a range of sequential entries to be retrieved in a 
logical OR relationship. 


Examples: 


SELECT CC=64072:64078 
SELECT ZP=662521:62526 


LIMIT QUALIFIERS 


imit qualifiers are used in SELECT statements to limit search terms or sets to 
given criteria. Specific qualifiers vary according to database. 


English language documents /} 
Major descriptor / 
Patents /PAT 
/ 
/ 


Human subject 
Accession number range 


nnnnnn-nnnnnn 


Examples: 


SELECT TRANSISTORS/ENG, PAT 
SELECT S2/MAJ 
SELECT (STRESS OR TENSION) /234567-999999 


[7] 


Well that’s it for basic searching. Now, how to view the record you have 
selected. 


Note: Indexes (prefix codes) often differ from database to 
database, often resulting in futile searches. One way to avoid this 
is to make a trip to the local Public or University Library and look 
up the blue sheets for the database you wish to query. Blue sheets 
are issued by dialog as a service to their users. Blue Sheets often 
contain helpful searching techniques ere to the database you are 
interested in. They will also contain a list of Indexes (prefix 
codes) unique to that database only. 


VIEWING SEARCH RESULTS 


COMMAND SUMMARY 


TYPE Provides continuous on-line display of results. 
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Examples: 


DISPLAY 
D 


Examples: 


PRINT 


Examples: 


PRINT TITLE xx 


Examples: 


REPORT 


QKCUUND 


PR 
PR 


Specify set/format/range of items. If Item range is specified, 
use T to view next record. May also be used with specific 
accession number. 


12/3/1-22 <- set/format/range 

8/7 <- set/format 

6 <- view next.(6 in this case) 
438721 <- view record 438721 


Provides display of results one screen at a time. Use 

PAGE for subsequent screens. 

Specify set/format/range of items. If range not specified, use 
D to view next record. May also be used with specific 
accession number. 


11/6/1-44 <- set/format/range 

9/5 <- set/format 

7 <- view next.(7 in this case) 
637372/7 <- view record 637372/format 7 


Requests that results be printed offline and mailed. Specify 
set/format/range of items. If item range not specified up to 
50 records will be printed. Use PR to print another 50. 


9/5/1-44 <- print set/format/range 

6/7 <- print set/format (all) 

14 <- print 14 only 

734443/5 <- print 734443 format 5 only. 


To specify a title(xxx) to appear on PRINTs. Title may 
contain up to 70 characters. No semicolon may be used. Must 
be entered in database before any other PRINT command is used. 
Cancelled by next BEGIN. 


TITLE GLOBULIN 
TITLE QUETZAL 


Extracts data from specified fields and produces tabular 
format for on-line output only. Specify set/range of 
items/fields. May be used with SORTED set to specify order of 
entries in table. Application is database-specific. 


TYPICAL FORMATS IN BIBLIOGRAPHIC FILES: 


Format Number 


OAAINDUOWNE 


Description 

DIALOG Accession Number 

Full Record except Abstract 
Bibliographic Citation 

Full Record 

Title 

Bibliographic Citation and Abstract 
Title and Indexing 


NOTE: Again, the Formats differ from database to database. 
See database bluesheet for specific format descriptions. 


PRINT CANCEL 
PR CANCEL 
PRINT- 

PR- 


ELATED COMMANDS: 


Used alone, cancels preceding PRINT command. 
Specify PRINT Transaction Number to cancel 
any PRINT request entered in past two hours, 
e.g. PRINT- P143 
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PRINT QUERY 
PR QUERY 


PRINT QUERY ACTIV 


PR QUERY ACTIVE 


SORT 


SET SCR 
Hon 
Vonn 


5 


EN nn nn 


n 
i) 


LOGOFF 
LOGOFF HOLD 


OTHER COMMANDS: 


DISPLAY SETS 


EXPLAIN 


sLIMITALL 


IMITALL/ALL 


n 
al 
> 


RCH* SAV. 


Gl 


SAVE 


SAVE TEMP 


SAVE SDI 


MAPxXx 
MAPxx TEMP 


[To view log of PRINT commands and cancellations. Add 
DETAIL to s date, time and costs. 


[To view log of PRINT commands that may still be cancelled. 
Add DETAIL to s date, time, file and costs. 


Sorts set of records on-line according to parameters 
indicated. Varies per database. Specify set 
number/range/field, sequence, e.g. SORT 4/1-55/AU,TI 
Sequence assumed ascending if not specified; use D to 
specify descending order. SORT parameters may be added to 
end of PRINT command for offline sorting, e.g. PRINT 
9/5/ALL/SD,D 


Sets size of screen for video display. 
H (horizontal) given first in combined command. 
V Default is 75 characters H, 40 lines V 


Disconnects user from DIALOG system. 
Disconnects user from DIALOG system, holds work for 10 
minutes allowing RECONNECT. 


Lists all sets formed since last BEGIN command. 
May specify range of sets, e.g. DS 10-22. 


Requests help messages for commands and file features. 
Enter ?EXPLAIN to see complete list. 


Places records indicated in special set 0. Specify 
set number/records, or accession number. Cancelled by a 
BEGIN command. Also used in DIALORDER. 


Limits all subsequent sets to criteria specified. Varies 
per database. 


Cancels previous LIMITALL command. 


Requests list of limit qualifiers for database n. 


Stores strategy permanently until deleted. Serial number 
begins with S. 


Stores strategy for seven days; automatically deleted. 
Serial number begins with T. 


Stores strategy and PRINT command(s) until deleted. PRINT 
command required. Automatically executes strategy against 
each new update to database in which entered. Serial 
number begins with D. 


Creates a Search*Save of data extracted for field xx of 
records already retrieved. 


If STEPS is used, data is formatted into separate search 
statements in Search*Save. 


REVIEWING SEARCH*SAVES 
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RECALL nnnnn Recalls Search*Save nnnnn, displaying all set-producing 
commands and comment lines, without executing the search. 
RECALL SAVE Displays serial numbers of all permanent SAVEs, date 
entered, and number of lines. 
RECALL TEMP Displays serial numbers of all temporary SAVEs, date 
entered, and number of lines. 
RECALL SDI Displays serial numbers of all SDIs, dates entered, 
databases in which stored, and number of lines. 
EXECUTING SEARCH* SAVES 
EXECUTE nnnnn Executes entire strategy. Only last line is assigned a 
EX nnnnn set number. 
EXECUTE STEPS nnnnn Executes entire strategy. Assigns set number to each 
EXS nnnnn search element. Preferred form. 
EXECUTE nnnnn/x-y Executes strategy nnnnn form command line x to command line 
y only. STEPS may also be used: EXS nnnnn/x-y 
EXECUTE nnnnn/USER a 
Executes strategy nnnnn originally entered by 
user a (a=user number). 
STEPS may also be used: EXS nnnnn/USER a 
EXECUTE nnnnn/x-y/USER a 
Executes strategy nnnnn from command line x to command line 
y, originally entered by user a. STEPS may also be used: 
EXS nnnnn/x-y/USER a 
DELETING SEARCH* SAVES 
RELEASE nnnnn Deletes search nnnnn from system. 
OTHER SEARCH*SAVE OPTIONS 
NAMING: A three to five alphanumerical name may be specified following the 
SAVE, SAVE TEMP, and SAVE SDI commands. 
Example: SAVE TEMP SOLAR 
COMMENTS: An informative comment may be stored in a SEARCH*SAVE by entering an 
asterisk in place of a command, followed by up to 240 characters of 
"comment." The line will be saved with any SEARCH*SAVE command, and 
will display in RECALL of the search. 
Example: * Search for R.J.Flappjack 
ON-LINE TEXT EDITOR 
Any Search*Save, with the exception of an SDI, may be edited from within any 
database. An SDI must be edited within the database in which the SDI is to be 
stored. 
EDIT To enter Editor and create new text. 
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EDIT xxxxx Pulls Search*Save xxxxx into Editor for editing. 
LIST Displays text to be edited. 
L OPTIONS: 
LIST LIST 30-110 
LIST ALL LIST 10,50, 80 
LIST /data/ Locates all lines containing data. 
INSER Adds onto end of text. 
INSERT nn Inserts line nn into text. 
I To return to EDIT from INSERT, enter a period ona 
I nn blank line. 
DELETE To delete line(s) of text. 
D OPTIONS: 
DELETE 10-50 
DELETE 10,30-50 
DELETE ALL 
CHANGE To change text within a line. 
Cc Changes only first occurrence of old text in any given line. 
OPTIONS: 
CHANGE 60/old/new (where 60 is line number) 
CHANGE 60/old// (deletes old) 
C 60//new (inserts new at beginning of line) 
C 80.old.new (when text contains slash) 
C /old/new (new replaces old on all lines) 
C 20,40/old/new (nonsequential lines) 
C 30-50/old/new (range of lines) 
COPY Duplicates line# TO line# 
CO OPTIONS: 
COPY 100 to 255 
COPY 100-150 TO 255 
COPY 100,130 TO 255 
MOVE Move line# TO line# 
M Options same as COPY. 
QUERY Produces message giving name of file, number of lines, last line 
Q number. 
RENUM Renumbers lines by tens unless otherwise specified. 
R OPTIONS: 
RENUM n (Renumbers by increments of n) 
QUIT Used to leave editor ignoring session. 
SAVE Used to create Search*Save strategy from edited file. 
SAVE TEMP An SDI must include a PRINT command. 
SAVE SDI 


ts 


njoy the DIALOG Information Network. I’ve found it most interesting. 
This service is a MUST if you are in college or if you just love to learn as 
uch as time permits. It is a proven research tool used by R&D and university 
facilities around the world, as well as a refined corporate intelligenc 
information gathering tool kept hidden from the general public by sheer expense 
and "pseudo-complexity." With on-line databases like DIALOG available, there 
is no excuse (besides lack of time) for self-education. 


KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKAKKKK 


Brian Oblivion can be reached at Oblivion@ATDT.ORG. 


Additionally, he can be reached at Black Crawling Systems/VOiD Information 
Archives (for more information, e-mail Brian). RDT welcomes any questions or 
comments you may have. See you at SummerCon ’92. 
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==Phrack Inc.== 


Volume Four, Issue Thirty-Nine, File 6 of 13 


Centigram Voice Mail System Consoles 
Proper Entry Procedure, Design Flaws, and Security Bugs 


by >Unknown User< 


*** Note from Phrack Staff: This file was submitted to Phrack anonymously. *** 
*** The author used SMTP fake mail to send it to the Phrack e-mail address. *** 
*** Phrack cannot make any claims about the validity or the source of the AE 
*** information found in this article. cas 


Due to more efficient task-handling and the desire for a more "Unix-like" 
environment, the developers at Centigram needed for certain key functions to be 
available at all times. For instance, the *Z key acts as the "escape" key 
(these can be remapped, if desired). When necessary for some applications to 
use an "escape" procedure, pressing this key can, in at least a few cases, 
cause a drop to shell, or /cmds/qnxsh (possibly /cmds/sh, as well, but I’m used 
to seeing qnxsh). If this escape procedure was invoked during, say, 
/cmds/login, the resulting drop to shell would by-pass the "Enter Passcode:" 
message. And it does. 


After calling the Centigram, normal procedure is to hit *%Z to activate the 
terminal, followed by the entry of the remote or console passcodes, and then 
proceeding with normal console activities. However, if *Z is continually 
depressed during the login sequence, the login program will abort and run 
/comds/qnxsh. The behavior may be somewhat erratic by the repeated use of the 


escape key, but when the $ prompt appears, usually, it doesn’t deliberately go 
away without an "exit" command or a “D. Typically, a login pattern can develop 
to accommodate the erratic behavior something along the lines of: continuously 


depress *Z until $ prompt appears, hit return, possibly get "Enter Passcode:" 
message, hit return, and $ prompt appears again, set proper TTY setting, and 
change directory appropriately, and continue with normal console functions. 


Initial STTY Setting: 


I’ve had problems with my terminal settings not being set properly during 
the above entry procedure. I can correct this by using the "stty t+techo +edit" 
command, and, for my terminal, all is restored. The correct values for STTY 
options and keys appear to be: 


Options: techo tedit tetab ters del +toflow tmapcr thangup 
break=03h esc=l1Ah rub=7Fh can=18h eot=04h up=15h 
down=0Ah left=08h ins=0Eh de1l=0Bh 


The keymap, of course, can be modified as desired, but the options, 
especially tedit, appear to be necessary. 


Disks and Directories: 


The drives and directories are set up in a remotely MessDos fashion. The 
output of a "pwd" command looks similar to "4:/". "4:" represents the drive 
number, and "/" is the start of the directory structure, "4:/" being the root 
directory for drive 4, "3:/tmp" being the /tmp directory on drive 3, etc. 


The two most important directories are 1:/cmds and 4:/cmds, which contain, 
for the most part, the program files for all of the performable commands on the 
system, excluding the commands written into the shell. The directory 1:/cmds 
should look similar to: 


S$ ls 

backup drel Ls rm talk 
chattr eo mkdir rmdir tcap 
choose fdformat mount runfloppy timer 
clrhouse files p search tsk 


ep frel pack sh unpack 
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date get_boolean patch slay ws 
ddump led pwd sleep zap 
diff led.init qnxsh spatch 
dinit login query stty 
This is a display of many useful commands. chattr changes the read/write 


file attributes, cp is copy, ddump dumps disk sectors in hex & ascii, led is 
the line editor, p is the file print utility, and a variety of other things 
that you can experiment with at your own leisure. DO NOT USE THE TALK COMMAND. 
At least, be careful if you do. If you try to communicate with your own 
terminal, it locks communication with the shell, and upon hangup, for some 
reason, causes a major system error and system-wide reboot, which, quite 
frankly, made me say, "Oops. I’m not doing that again" when I called to check 
on the actual voice mailboxes, and the phone line just sat there, dead as old 
wood. I was quite relieved that it came back up after a few minutes. 


The other directory, 4:/cmds, is filled with more specific commands 
pertaining to functions within the voice mail system itself. These programs 
are actually run from within other programs to produce an easy-to-understand 
menu system. Normally, this menu system is immediately run after the entry of 
the remote or console passcode, but it would not be run when using the 
aforementioned security bug. It can be run from the shell simply by typing the 
name of the program, console. 


Mounting and Initializing Drives: 


The MOUNT command produces results similar to this when run without 
arguments: 


S mount 

Drive 1: Hard, 360k, offset = 256k, partition= Qnx 
Drive 2 Floppy, 360k, p=1 

Drive 3: RamDisk, 96k, partition= Qnx 

Drive 4 Hard, 6.1M, offset = 616k, partition= Qnx 
SttyO = Scon , Serial at 03F8 

Sttyl = Sterml , Serial at 02F8 

Stty2 = Sterm2 , Serial at 0420 

Stty3 = Smdm : Serial at 0428 


The hard and floppy drives are fairly self-explanatory, although I can’t 
explain why they appear to be so small, nor do I know where the voic 
recordings go, or if this list contain all the space required for voice 
storage. 


The ramdisk, however, is a bit more interesting to me. The mount command 
used for the above-mentioned disk 3 was: 


S$ mount ramdisk 3 s=96k -v 


Although I’m not sure what the -v qualifier does, the rest is fairly 
straight forward. I assume that the size of the drive can be greater than 96k, 
although I haven’t yet played with it to see how far it can go. To initialize 
the drive, the following command was used: 


$ dinit 3 


Quite simple, really. Now, the drive is ready for use so one can "mkdir 
3:/tmp" or some such and route files there as desired, or use it for whatever 
purpose. If something is accidentally redirected to the console with >S$cons, 
you can use the line editor "led" to create a temporary file and then use the 
print utility "p" to clear the console’s screen by using "p filename >S$cons" 
where filename contains a clear screen of 25 lines, or an ANSI bomb (if 
appropriate), or a full-screen DobbsHead or whatever you like. 


EVMON and password collecting: 


The evmon utility is responsible for informing the system manager about 
the activity currently taking place within the voice mail system. Run alone, 


6.txt Wed Apr 26 09:43:39 2017 3 


evmon produces output similar to: 


S evmon 

Type Ctrl-C to terminate. 
26 tt 3 

26 line break 
26 onhook 

28 ringing 

28 tt 8 

28 tt 7 

28 tt 6 

28 tt 2 

28 offhook 

28. tt-* 

28 tt 2 

28 tt 0 

28 tt 3 

28 tt 0 

28 line break 
28 onhook 

| 


PYPVPDVD VDDD DVD VV YD YD YP DPD 


And so forth. This identifies a certain phone line, such as line 28, anda 
certain action taking place on the line, such as the line ringing, going on or 


offhook, etc. The "tt" stands for touch tone, and it is, of course, the tone 
currently played on the line; which means that touchtone entry of passcodes can 
be recorded and filed at will. In the abov xample, the passcode for Mailbox 


8762 is 2030 (the * key, along with the 0 key, can acts as the "user entering 
mailbox" key; it can, however, also be the abort key during passcode entry, and 
other things as well). Now the user, of course, doesn’t usually dial 8762 to 
enter his mailbox; he simply dials the mailbox number and then * plus his 
passcode; the reason for this is the type of signalling coming from the switch 
to this particular business line was set-up for four digit touch tone ID to 
route the line to the appropriate called number. This is not the only method 
of signalling, however, as I’ve seen other businesses that use three digit 
pulse signalling, for example, and there are others as well. Each may have 
it’s own eccentricities, but I would imagine that the line ID would be 
displayed with EVMON in most cases. 


Now, let’s say we’re on-line, and we want to play around, and we want to 
collect passcodes. We’ve set up our ramdisk to normal size and we are ready to 
run evmon. We could run it, sit at our terminal, and then record the output, 
but it’s such a time consuming task (this is "real-time," after all) that 
sitting and waiting be nearly pointless. So, we use the handy features of 
run-in-background and file-redirection (see, I told you we were getting 
"Unix-like"). 


$ evmon > 3:/tmp/output & 
Type Ctrl-C to terminate. 
Sele 

$ 


5ele is the task ID (TID) of the new evmon process. Now we can go off and 
perform whatever lists we want, or just play in the directories, or route 
DobbsHeads or whatever. When we decide to end for the day, we simply stop 
EVMON, nab the file, remove it, and if necessary, dismount the ramdisk. 


kill 5ele 

p 3:/tmp/output 

EVMON output would normally appear; if, however, ] 
there is none, the file would be deleted during ] 
the kill with an error message resulting ] 
rm 3:/tmp/output 

rmdir 3:/tmp 

mount ramdisk 3 


Op ite Op a OP le Ee Ben OP OP 


and now we can *D or exit out of the shell and say good-bye. 
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on-line while it runs. 


until the 


4 


EVMON procedure 
You could start a task 


next day before you kill the process 


usually produces 
amount of 
start the 
able to start a new 
probably shou 


system usage 


become a little risky. 


Remember though, 


administrator decides to check his mailbox; 
possibly, 


large log files anywhere from 
(these figures are rough estimates). 
EVMON task and leave it running, 
EVMON session until the old task is killed. 
ldn’t be a problem over th 


WwW 


that the risk might be worth it, 


kends, 


is that you don’t need to be 

sometime at night and then wait 
and check your results. 
40K to 200K, depending upon the 


then the administrator wil 


remot 


telephon 


tone on the mailbox system. 


Task management: 


As we have just noted, 


appending the command line with a &, 


any task like 


If, 


however, 
ll not be 
While this 
during business hours it may 


especially if the 
you’d then have his passcode, 
access to system administrator functions via touch- 


This 


you 


and, 


EVMON can be run in the background by 


the standard Unix "run-in-background" 


character. A Task ID will echo back in hexadecimal, quite comparable to the 
Unix Process ID. The program responsible for task management is called "tsk" 
and should be in 1:/cmds/tsk. Output from running tsk alone should look 
something like: 
S tsk 
Tty Program Tid State Blk Pri Flags Grp Mem Dad Bro Son 
0 task 0001 READY aE IPLA 255) 255 
0 fsys 0002 RECV 0000 3 -—--IPLA----- 299% 299 
0 dev 0003 RECV 0000 2 -—--IPLA----- 255: 255 
0 idle 0004 READY 15 PLA 299: 25.0) SSeS Sss= 0508 
0 /cmds/timer 0607 RECV 0000 2 -S--P-AC---- 255 255 
0 /cmds/err_log 0509 RECV 0000 5 -S--P--C---- 255 255 OAOA ---- ---- 
0 /comds/ovrseer OAOA REPLY 0607 5 -S--P--C---- 255 255 ---- ---- 030C 
0 /omds/recorder 010B REPLY 0509 5 -—S--P--C---- 255 255 OAOA 0509 ---- 
0 /cmds/master 030C REPLY 0607 5 -S-—-P--C---- 255 255 OAOA 010B 011C 
[ a wide assortment of programs | 
0 /cmds/vmemo 011C REPLY 0110 13 -S-----C---- 255 255 030C 011B ---- 
3 /cmds/comm 0508 RECV 5622 8 ----P-A----- 255 255 0004 ---- 5622 
3 /omds/tsk 051D REPLY 0001 8 -—-~~~-------- 259. 255: 3078 =--e) -- o> 
3 /emds/qnxsh 301E REPLY 0001 14 --------- B-= 255.255 3622 --==- 057d 
3 /omds/login 5622 REPLY 0003 8 -—------ C---- 255 255 0508 ---- 301E 


Although I’m not quite sure at 
the important parts are obvious. 
which corresponds to the Stty 
called is Stty3, 


output, 


and I am simul 


the second column is the 
third column is the task 


thr 


ties 


represent th 


task ID created from the 


list in 


program name 
TD: 


and relations to other tasks 
and task 


"mount" 


some of the specifics displayed in t 


his 


The first column is the TTY number 
(meaning that the modem I’ve just 
ltaneously running four tasks from that li 


ne); 


(without the drive specification); the 
the middle columns are unknown to me; and the last 
(parent task ID, another 


Knowing this, 
task 0508, 


nitially, 
equisite 


a 
G 
W 
[e) 
t 
t 


Nnere 


There are other functions of the tsk program as well. 


lists: 


S$ tsk ? 
use: tsk 


As mentioned, 
[task-id] 


[f={cmoprst}] 
tsk code 


qnxsh 


[p=program 


/comds/comm, 


[p=program] 


same parent, 


was run, 


, was called to handle 
the /cmds/tsk 


to kill a task from the shell, 
is the four digit hexadecimal number. 


[t=tty] [u=u 


] 


ID of any program called). 


it’s easy to follow the tasks we’ve created since login. 
which presumably contains the 

"what should I do now that my user has pressed a key?" 
hich called /cmds/login to log the user in. 
ne of the shells, 
he typing of "tsk" requires that 
he output of the program is simp] 


functions, 


Login was interrupted with *%Z and 


ly confirming that it exists. 


input from the user. Finally, 
program be given a task ID, and 
simply type "kill [task-id]" 


The help screen 


serid] 
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tsk info 
tsk mem t=tid 


tsk names 
tsk size [p=program] [t=tty] [u=userid] 
tsk ports 
tsk tsk 
tsk tree [+tid] [tall] [-net] 
tsk users [p=program] [t=tty] [u=userid] 
tsk vcs 
tsk who tid 
options: +qnx -header +physical [n=]node s=sort_field 
I haven’t seen all the information available from this, yet, as the plain 


"tsk" tells me everything I need to know; however, you may want to play around: 
there’s no telling what secrets are hidden... 


$ tsk tsk 
Tsk tsk? Have I been a bad computer? 


See what I mean? 
ddump: 


The ddump utility is used to display the contents on a specified blocks of 
the disk. It’s quite simple to use. 


S ddump ? 
use: ddump drive block_number [-v] 


Again, I’m not quite sure what the -v switch does, but the instructions 
are very straightforward. Normal output looks similar to: 


S$ ddump 3 3 

Place diskette in drive 3 and hit <CR> <-- this message is always 
displayed by ddump. 
Block 00000003 Status: 00 

000: 00 00 00 00 00 00 00 00 94 00 00 00 00 00 00 00 ................ 


010: O01 00 01 00 40 02 00 00 00 02 00 00 00 00 00 00 ....@........... 
0203. 00 01:00 FE FE .00.00, 97 37°29 17 00 04, (O01 01. 30: ea eas Ti) ts ahetees ) 
030: C4 17 8E 62 69 74 6D 61 70 00 00 00 00 00 00 00 ...bitmap....... 
040: 00 00 00 00 CO 00 00 00 00 00 00 00 00 00 00 00 ....... ee. eee eee, 
050: 00 00 00 FF FF 00 00 A5 37 29 17 00 01 01 17 30 ........ LY ceheteay 0 
060: C4 25 8E 6C 6C 6C 00 00 00 00 00 00 00 00 00 00 .%.11ll.......... 
070: 00 00 00 00 50 OE 00 00 00 OF 00 00 00 00 00 00 ....P........... 
080: O00 01 00 FF FF 7E 05 A8 38 29 17 00 01 0117 30 ..... Sie: S108) 9S EN 0) 
090: C4 28 8F 61 62 63 00 00 00 00 00 00 00 00 00 00 .(.abc.......... 


OAO: O00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 OO ................ 
OBO: O00 00 00 00 00 00 00 00 00 00 00 00 00 00 O00 OO ................ 
[air ekes <3] 


As you can probably notice, what we have here is the directory track for 
the ramdisk. It lists thr files, even though the file abc no longer exists. 
The actual bytes have yet to be decoded, but, as far as the ramdisk goes, I 
suspect that they’1ll be memory related, and not physical block related; that 
is, I suspect that some of the numbers given above correspond to the memory 
address of the file, and not to the actual disk-block. So, at least for the 
ramdisk, finding specific files may be difficult. However, if you only have 
one file on the ramdisk besides "bitmap" (which appears to be mandatory across 
all the disks), then the next file you create should reside on track 4 and 


continue working its way up. Therefore, if you have evmon running and 
redirected to a file on the ramdisk, in order to check the contents, it’s not 
necessary to kill the process and restart evmon, etc. Simply "ddump 3 4" and 


you could get either useless information (all the bytes are 00 or FF), or you 
could get something like: 


S ddump 3 4 
Place diskette in drive 3 and hit <CR> 
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Block 00000004 Status: 00 


000: 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 ...... ee. ee eee. 
010: 6C 6E 20 20 32 36 20 74 74 20 33 1E 6C 6E 20 20 In 26 tt 3.1n 
020: 32 36 20 6C 69 6E 65 20 62 72 65 61 6B 1E 6C 6E 26 line break.1in 
030: 20 20 32 36 20 6F 6E 68 6F 6F 6B 1E 6C 6E 20 20 26 onhook.1in 
040: 32 38 20 72 69 6E 67 69 6E 67 1E 6C 6E 20 20 32 28 ringing.ln 2 
050: 38 20 74 74 20 38 1E 6C 6E 20 20 32 38 20 74 74 8 tt 8.ln 28 tt 


060: 20 37 1E 6C 6E 20 20 32 38 20 74 74 20 36 1E 6C V.1in 28 tt 6.1 
O70: 6E 20 20 32 38 20 74 74 20 32 1E 6C 6E 20 20 32 n 28 tt 2.1ln 2 
080: 38 20 6F 66 66 68 OF 6F 6B 1E 6C 6E 20 20 32 38 8 offhook.in 28 
090: 20 74 74 20 2A 1E 6C 6E 20 20 32 38 20 74 74 20 tt *.1ln 28 tt 


And so forth, thus making sure that the file does have some content. 
Depending upon the length of that content, you could then choose to either keep 
the file running, or restart evmon and buffer the previous output. 


led: 


The program "led" is Centigram’s answer to a standard text editor. It is 
equivalent to "ed" in Unix or "edlin" in MS-DOS, but it does have its minor 
differences. "led" is used to create text files, edit existing log files, or 
edit executable shell scripts. By typing "led [filename]", you will enter the 
led editor, and if a filename is specified, and it exists, the file will be 
loaded and the editor set to line 1. If there is no filename on the command 
line, the file does not exist, or the file is busy, then led begins editing a 
null file, an empty buffer, without the corresponding filename. 


Commands can also be specified to be used in led after the filename is 
entered. If needed, you can experiment with this. 


Notable commands from within led: 


a insert 
a append 
w [filename] write to disk; if no file is named, attempt to 


write to current file; if there is no current 
file, do not write. 


d delete current line 
a number goto line numbered 
q quit (if not saved, inform user to use "qq") 
qq really quit 
When inserting or appending, led will prompt you with a "." period. To 
end your entry, simply enter one period alone on a line and you will then 
return to command mode. When displaying the current entry, led will prefix all 


new, updated lines, with the "i" character. 


[The key sequence to enter a DobbsHead into a file and redirect it to the 
console, then, would be: 


S led 3:/dobbshead 
3:/dobbshead : unable to match file 


rl. 

/ \ 

| oo | 

gr wl Y | 

U===== | 

\ / 

? FUCK YOU! 
gq 


?4 buffer has been modified, use qq to quit without saving 
w 3:/dobbshead 
7 [the number of lines in the file] 


Fg 
S p 3:/dobbshead > $cons 
S rm 3:/dobbshead 
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Ok, so it’s not quite the DobbsHead. Fuck you. 


The console utility: 


The program that acts as the menu driver for the Voice Mail System 
Administration, the program that is normally run upon correct passcode entry, 
is /cmds/console. This program will simply produce a menu with a variety of 
sub-menus that allow the administrator to perform a wide assortment of tasks. 
Since this is mostly self-explanatory, I’1l let you find out about these 
functions for yourself; I will, however, add just a few comments about the 
console utility. The first menu received should look like this: 


(c) All Software Copyright 1983, 1989 Centigram Corporation 
All Rights Reserved. 


MAIN MENU 
(M) Mailbox maintenance 
(R) Report generation 
(S) System maintenance 
(X) Exit 
Enter letter in () to execute command. 


When you need help later, type ?. 


COMMAND (M/R/S/X): 
The mailbox maintenance option is used when you want to find specific 
information concerning mailboxes on the system. For instance, to get a listing 

of all the mailboxes currently being used on the system: 


COMMAND (M/R/S/X): m 


MAILBOX MAINTENANCE 


) Mailbox block inquiry 
) Create new mailboxes 
) Delete mailboxes 
) Mailbox dump 

) Inquire about mailboxes 
.) List maintenance 
) 

) 

) 

) 

) 


7TUaQW 


H 


Modify mailboxes 

Set passcode/tutorial 
Rotational mailboxes 

Search for mailboxes 

Exit 


M 
P: 
R 
S 
Xx 


Soph a ee Me ett eet et So etn nant OR 


If you need help later, type ?. 


COMMAND (B/C/D/E/1I/L/M/P/R/S/X): i 
Report destination (c/sl/s2) [c]: 


Mailbox to display: 0000-9999 


>>> BOBTEL <<< 
Mailbox Data Inquiry 
Tue Mar 31, 1992 3:07 am 


Box Msgs Unp Urg Rec Mins FCOS LCOS GCOS NCOS MWI Passwd 
8001 al ib 0 0 O05 5 1 cL None Y 

8002 0 0 0 0 O01 5 5 None Ye ECE) 
8003 0 0 0 0 0.0 12 12 None nis 

8005 0 0 0 0 0.0 12 12 None ¥ 

8006 6 6 0 0 Of 22 2 None N 

8008 0 0 0 0 0.0 5 5 None Y 

8013 0 0 0 0 0.0 12 12 None 1234 
8014 0 0 0 0 0.0 5 5 None Y 

8016 0 0 0 0 0.0 12 12 None Y 
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This simply lists every box along with the relevant information concerning 
that box. Msgs, Unp, Urg, Rec are the Total number of messages, number of 
unplayed messages, number of urgent messages, and number of received messages 
currently being stored on the drive for the mailbox; Mins is the numbers of 
minutes currently being used by those messages; F, L, G, and NCOS are various 
classes of service for the mailboxes; MWI is the message waiting indicator, or 
service light; and Passwd is simply a Yes/No condition informing the 
administrator whether the mailbox currently has a password. The "(t)" in the 
password field means the box is currently in tutorial mode, and the "1234" that 
replaces the Y/N condition, which means the box is set to initial tutorial mode 
with simple passcode 1234 -- in other words the box is available to be used by 
a new subscriber. Mailboxes with FCOS of 1 should be looked for: these 
represent administration or service mailboxes, although they are not 
necessarily capable of performing system administration functions. 


The System Maintenance option from the main menu is very useful in that, 
if you don’t have access to the gqnxsh, you can still run a number of tasks or 
print out any file you wish from within the menu system. The System 
Maintenance menu looks like: 


[J 


SYSTEM MAINTENANC 


Automatic Wakeup 

Automated Receptionist Extensions 
Display modem passcode 

Enable modem/serial port 

Floppy backup 

Resynchronize HIS PMS room status 
Hard Disk Utilities 

Lights test 

Manual message purge 

System name 

Passcode 

Reconfiguration 

System shutdown 

Time and date 

Utility menu 

Call Detail Recorder 

Network menu 

Exit 


AoW PY 


m@ "4 


Sa NS Teen, SN aS mers nip ee Sie nn oe en tet 


XSSQCHNDUAEE 


Enter letter in () to execute command. 
When you need help later, type ?. 


COMMAND (A/B/D/E/F/G/H/L/M/N/P/R/S/T/U/V/W/X) : 
If you don’t have access to the "p" command, you can still display any 


specific file on the drive that you wish to see. Choose "v," the Call Detail 
Recorder option from above, and you will get this menu: 


COMMAND (A/B/D/E/F/G/H/L/M/N/P/R/S/T/U/V/W/X): v 
Warning: cdr is not running. 


CALL DETAIL RECORDER MENU 


Configure CDR 
Run CDR 
Terminate CDR 
Run EVMON 
Terminate EVMON 


Show CDR log file 
Delete CDR log file 
Exit 


<XxUOnNAAHADWOA 


ete Oe a ph ee tee 


If you need help later, type ?. 
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COMMAND (C/R/T/E/F/S/D/X): 


From here, you can use (C) Configure CDR to set the log file to any name 
that you want, and use (S) to print that file to your terminal. 


COMMAND (C/R/T/E/F/S/D/X): c 


Answer the following question to configure call detail recorder 
[ simply hit return until the last "filename" question come up ] 
VoiceMemo line numbers enabled: 
HOST 1 lines: 

0 1 2 3 4 5 6 7 8 910 11 12 13 14 15 

16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 
VoiceMemo line numbers: 


EVMON: HOST 1 lines to monitor: 
Ol de 2. Br A cb Be DO POT 12-13 TA. 5 
16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 
EVMON:VoiceMemo line numbers: 
Message levels ar 
Detailed VoiceMemo 
VoiceMemo 
Pager 
Receptionist 
EVMON 
Automatic WakeUp 
Open Account Administrator 
DTMF to PBX 
Message Waiting Lamp 

10: SL-1 integration 

11: Centrex Integration 
Message levels enabled: 
Bow Be Sh 19) 
Message levels: 
cdr enable = [N] 
Enter filename to save log data = [/logfile] /config/remote.cmds 


DAAINOABWNE 


Ne} 


Returning from the CDR configuration. 


CALL DETAIL RECORDER MENU 


Show CDR log file 
Delete CDR log file 
Exit 


C) Configure CDR 

R Run CDR 

T) Terminate CDR 
EB Run EVMON 

F) Terminate EVMON 
S 

D 

xX 


Sate lee RES a ee Se 


If you need help later, type ?. 


COMMAND (C/R/T/E/F/S/D/X): s 
ad 

cd 

copy 

date 

dskchk 
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Don’t forget to return the filename back to its original name as shown in 
the [] field after you have finished. 


If you don’t have access to the shell, you can also run EVMON, from the 


CDR menu, using option E. It will simply start the evmon process displaying to 
your terminal, interruptable by the break character, *C. This, unfortunately, 
cannot be redirected or run in the background as tasks running from the shell 
can. If, however, you have some time to kill, you may want to play with it. 


Also, from the System Maintenance menu, you can perform a number of shell 
tasks without direct access to the shell. Option (U), Utilities Menu, has an 
option called Task. This will allow you limited shell access, possibly with 
redirection and "&" back-grounding. 


COMMAND (A/B/D/E/F/G/H/L/M/N/P/R/S/T/U/V/W/X) : U 


UTILITY MENU 


(B) Reboot 

(H) History 

(T) Task 

(X) Exit 

Enter letter in () to execute command. 


When you need help later, type ?. 


COMMAND (B/H/T/X): t 


Choose the following commands: 


ad cd copy date 

dskchk evmon files ls 

mount p pwd query 
task tcap what 


Enter a command name or "X" to exit: pwd 


Arif 
Choose the following commands: 
ad cd copy date 
dskchk evmon files ls 
mount p pwd query 
task tcap what 
Enter a command name or "X" to exit: evmon 
Type Ctrl-C to terminate. 
In 29 ringing 
In 29 tt 8 
In 29 tt 0 
bi 2:9: "Et “8 
Ey 29) 8G 36 
ln 29 offhook 
In 29 record ended 
CIES? sosus | 


A look at "ad": 


The program "ad" is called to dump information on a variety of things, the 
most useful being mailboxes. Dumps of specific information about a mailbox can 
be done either in Mailbox format, or Raw Dump format. Mailbox format looks 
like: 


S ad 

Type #: 0 

Mailbox #: 8486 

(M) ailbox, (D)ump ? m 


MAILBOX: 8486 
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Login status: 


Bad logs = 3 Last log = 03/26/92 12:19 pmVersion = 0 
Configuration: 
Name # = 207314 Greeting = 207309 Greeting2 = 0 
Passcode = XXXXXXXXXX Tutorial =N Extension = 8486 
Ext index = 0 Attendant = Attend index = 0 
Code = ID = BOBTECH 
Day_treat =M Night_treat =M Fcos = 12 
Lcos = 12 Gcos = 1 Ncos = 1 
Rot index = 0 Rot period = 0 
Rot start == 
wkup defined = N wkup freq = 0 wkup_intvl = 0 
wkup index = 0 wkup number = 
Contents: 
Motd_seq 8 Motd_played =N User_msgs 0 
Caller_msgs = 4 Sent_cpx_msgs= 0 Sent_fdx_msgs= 0 
Sent_urg_msgs= 0 Tas_msgs = 0 Pages = 0 
Receipt = 0 Sent_to_node = 0 Urg_to_node = 0 
Net_urg_mlen = 0 Net_msgs_rcev = 0 Net_urg_rcv = 0 
Net_sent_node= 0 Net_send_nurg= 0 Net_send_rcep = 0 
Greet_count = 9 Successlogins= 1 Recpt_calls = 0 
Recpt_complt = 0 Recpt_busy 0 Recpt_rna = 0 
Recpt_msgs = 0 Recpt_attend = 0 User_connect = 20 
Clr_connect = 22 Callp_connect= 0 Disk_use = 498 
Net_sent_mlen= 0 Net_rcvd_mlen= 0 Net_rcevd_urg = 0 
Net_node_mlen= 0 Net_recip_mlen=0 Net_node_urg = 0 
Text_msg_cnt = 0 
Message Queues: 
TYPE COUNT TOTAL HEAD TAIL TYPE COUNT TOTAL HEAD TAIL 
Free 71 —o 58 55 Unplayed 0 or -1 =] 
Played 2 0.5 56 57 Urgent 0 = -1 -1 
Receipts 0 a — 1, el Undelivered 0 aos =1 =a 
Future delivery 0 aes ate —1 Call placement 0 oo -1 regi 
Messages: 2 
# msg # DATE TIME LENGTH SENDER PORT FLAGS MSG SIBL 
(MINS) NXT PRV NXT PRV 
Played Queue 
56 207126 03/26/92 12:17 pm 0.5 000000000000000 27 —-----—- Pe> SY. “Sl Sh 
57 207147 03/26/92 12:19 pm 0.1 000000000000000 29 -—---—- Poy oth, SoG, silted 
The Raw Dump format looks like: 
$ ad 
Type #: 0 


Mailbox #: 8487 
(M) ailbox, (D)ump ? d 


HEX: 8487 

000: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
010: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
020: 00 00 00 00 00 00 00 00 —- 00 00 00 00 00 00 34 38 |.............. 48 
030: 37 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |7............... 
040: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
050: 00 00 00 00 00 00 00 00 —- 00 00 42 49 4f 54 45 43 |.......... BOBTEC 
060: 48 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 OO |H............... 
070: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
080: 00 00 00 00 00 00 00 00 —- 00 00 00 00 00 37 32 33 |............. 723 
090: 36 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |6............... 
O0a0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
Ob0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
Oc0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 |................ 
[mostly deleted the list continues to hex fff.] 
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One of the unfortunate aspects is that the password is not displayed in 
the Mailbox format (Awwww!). I can tell you now, though, that it also isn’t 
displayed anywhere in the Raw Dump format. The program "asetpass" was used to 
change the password of a test mailbox, and both full dumps were downloaded and 
compared; they matched exactly. So, it looks like the passcodes are probably 
stored somewher lse, and the dump simply contains a link to the appropriate 
offset; which means the only way, so far, to get passcodes for mailboxes is to 
capture them in EVMON. 


Intricacies of the login program: 


The console login program is 1:/cmds/login. Although I can’t even 
recognize any valid 8080 series assembly in the program (and I’m told the 
Centigram boxes run on the 8080 family), I did manage to find a few interesting 


tidbits inside of it. First, the console and remote passwords seems to be 
stored in the file /config/rates; unfortunately, it’s encrypted and I’m not 
going to try to break the scheme. /config/rates looks like this: 


S$ p /config/rates 

\CE\FFC~C7~ \0A\00\00\00\00\00\0A\00\00\00\00\00\0A\00\00\00\00\00\0A\00\00\00\00 
\OO\OA\O0\O00\O00\O00\O0\OA\O00\O00\00\O00\O00\OA\00\00\00\00\00\00\00\00\00\00\00\00 
\OO\OO\O0\O0\O0\O0\O0\O0\O0\O0\00\O0\00\00\00\00\00\00\00\00\00\00\00\00\00\00 


a 


Accepting the \CE as some sort of control byte, this file is divided up 
into about eight empty sections of five bytes a piece, mostly null, indicating 
that, possibly, there are a number of acceptable passcode combinations, or a 
number of different functions with different passcodes. In this instance, only 
one passcode appears to be selected. I am still unsure, however, whether this 
is actually a password file, or a file that would act as a pointer to another 
space on the disk which contains the actual password. I would assume, for this 
login program, that it is actually an encrypted password. 


Another very interesting thing sleeping within the confines of the login 
program is the inconspicuous string "ONX." It sits in the code between two 
"Enter Passcode:" prompts, separated by \00s. I believe this to be a system 
wide backdoor placed into the login program by Centigram, Corp. Such a thing 
does exist; whenever Centigram wants to get into a certain mailbox system to 
perform maintenance or solve a problem, they can. They may, however, requir 
the serial number of the machine or of the hard drive, in order to get this 


access. This serial number would be provided by the company requiring service. 


When logging in with ONX, a very strange thing happens. 


(*Z) 
Enter Passcode: (QNX*M) Enter Passcode: 


A second passcode prompt appears, a prompt in which the "QNX" passcode 
produces an Invalid Passcode message. I believe that when Centigram logs in 
from remote, they use this procedure, along with either a predetermined 
passcode, or a passcode determined based on a serial number, to access the 
system. I have not ever seen this procedure actually done, but it is the best 
speculation that I can give. 


I should also make note of a somewhat less important point. Should the 
console have no passcodes assigned, a simple “Z for terminal activation will 
start the /cmds/console program, and log the user directly in without prompting 
for a passcode. The odds on finding a Centigram like this, nowadays, is 
probably as remote as being struck by lightning, but personally, I can recall a 
time a number of years back when a Florida company hadn’t yet passcode 
protected a Centigram. It was very fun to have such a large number of people 
communicating back and forth in normal voice; it was even more fun to hop on 
conferences with a number of people and record the stupidity of the average 
Bell operator. 


Special Keys or Strings: 


There are a number of special characters or strings that are important to 
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ither the shell or the program being executed. Some of these are: 


? after the program name, gives help list for that program. 
runs a task in the background 
sets the comment field (for text within shell scripts) 


command delimiter within the shell 

> redirects output of a task to a file 

< (theoretically) routes input from a file 
Scons the "filename" of the consol (redirectable) 


Stty# the "filename" of tty number "#" 
Smdm the "filename" of the modem line 


S$ ? produces a value like "1920", "321d" 

probably the TID of the current process 

# ? produces a value like "ffff" 

% ? produces a value like "0020", "001d" 

& ? produces a value like "0000" 

? ? produces a value like "0000" 

* a null argument 

g ? produces a value like "OOff" 

j directly followed by a number, produces "0000" 
not followed, produces the error "non-existent integer variable" probably 
used in conjunction with environment variables 

k accepts a line from current input (stdin) to be 
substituted on the command line 

m 2. “OOLE™ 

n >? "0000" 

Pp 2? "0042" 

s produces the error "non-existent string variable" probably used in 
conjunction with environment variables 

t 2° "0003" 

u 2? some string similar to "system" 

D 2? "0018" 

M 2? "0004" 

% 2 "005c" 


"Centigram Voice Mail System Consoles" was written anonymously. There are no 
group affiliations tied to this file. 
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==Phrack Inc.== 


a 
Ww 


Volume Four, Issue Thirty-Nine, File 7 of 


> 
> 


LON ONG af ON Sf OXON A ON af ON of OX EN OX 


> 
> 


> 
> 


Special Area Codes II 


> 
> 


> 
> 


by Bill Huttig 
wah@ZACH.FIT.EDU 


> 
> 


> 
> 


February 24, 1992 


> 
> 


> 
> 


TA SAA Ss Be TS TSS 
> 

a an an an an an an a an 

MS A RS, TE A RO 
> 

a an an a an an a a a 


PON APS, PON AES, PON, AON, POX OX fe ON, PX 


The first "Special Area Codes" file appeared in Phrack Issue 24, but here 

is an updated listing of the prefixes used with 800 toll free service. This 
list shows which carrier handles calls placed to 800-XXX numbers. Choice of 
carrier routing on calls to 800-xxx numbers cannot be overridden with 10xxx 
routing. It should also be noted that on calls to 800 numbers, the called 
party either immediatly in some instances or on a delayed basis receives a 
record of numbers which called. This identification of the calling party 
cannot be overridden with *67 or the "line-blocking" associated with Caller-ID. 


202 RCCP RADIO COMMON CARRIER PAGING 
212 RCCP RADIO COMMON CARRIER PAGING 
213 9348 CINCINNATI BELL TELEPHONE 


220 ATZ ATX-COMMUNICATIONS 

221 ATX AT&TI-C 

222 ATX AT&TI-C 

223 ATX AT&TI-C 

224 LDL LONG DISTANCE FOR LESS 

225 ATX AT&TI-C 

226 ATL ATC 

227 ATX AT&TI-C 

228 ATX AT&TI-C 

229 TDX CABLE & WIRELESS COMMUNICATIONS 
230 NIK NETWORK TELEMANAGEMENT SERVICES 
231 ATX AT&TI-C 

232 ATX AT&TI-C 

233 ATX AT&TI-C 

234 MCI MCI TELECOMMUNICATIONS CORPORATION 
235 ATX AT&T-C 

236 SCH SCHNEIDER COMMUNICATIONS 

237 ATX AT&TI-C 

238 ATX AT&TI-C 

239 DLT DELTA COMMUNICATIONS, INC. 

240 SIR SOUTHERN INTEREXCHANGE SERVICES 
241 ATX AT&TI-C 

242 ATX AT&TI-C 

243 ATX AT&TI-C 

244 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
245 ATX AT&TI-C 

246 9553 SOUTHWESTERN BELI 

247 ATX AT&T-C 

248 ATX AT&TI-C 

249 LWC LASSMAN-WEBER COMMUNICATIONS 
251 ATX AT&TI-C 

252 ATX AT&TI-C 

253 ATX AT&TI-C 

254 TIU TOTAL-TEL USA 

255 ATX AT&TI-C 

256 LSI JONG DISTANCE SAVERS 

257 ATX AT&TI-C 

258 ATX AT&TI-C 

259 LSI LONG DISTANCE SAVERS 
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260 COK COM-LINK21 

261 SCH SCHNEIDER COMMUNICATIONS 

262 ATX AT&TI-C 

263 CAN TELCOM CANADA 

264 LDD LDDS COMMUNICATIONS 

265 CAN ELCOM CANADA 

266 CSY COM SYSTEMS 

267 CAN ELCOM CANADA 

268 CAN ELCOM CANADA 

269 FDG FIRST DIGITAL NETWORK 

270 CRZ CLEARTEL COMMUNICATIONS 

271 TRA3 TRAFFIC ROUTING ADMINISTRATION 3 

272 ATX AT&TI-C 

273 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
274 MCI MCI TELECOMMUNICATIONS CORPORATION 
275 IT MTD/UNITED STATES TRANSMISSION SYSTEMS 
276 ONE ONE CALL COMMUNICATIONS, INC. 

277 SNI MCI / TDD / SOUTHERNNET, INC. 

279 MAL MIDAMERICAN 

280 ADG ADVANTAGE NETWORK, INC. 

282 ATX AT&TI-C 

283 MCI MCI TELECOMMUNICATIONS CORPORATION 
284 MCI MCI TELECOMMUNICATIONS CORPORATION 
286 9147 SOUTHERN NEW ENGLAND TELEPHONE 

287 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
288 MCI MCI TELECOMMUNICATIONS CORPORATION 
289 MCI MCI TELECOMMUNICATIONS CORPORATION 
292 ATX AT&TI-C 

293 PRO PROTO-COL 

294 FDC AFFORD A CALL 

295 ACT ACC LONG DISTANCE CORPORATION 

296 LDW LONG DISTANCE SERVICE, INC. 

297 ARE AMERICAN EXPRESS TRS 

298 CNO COMTEL OF NEW ORLEANS 

299 ATL ATC 

302 RCCP RADIO COMMON CARRIER PAGING 

312 RCCP RADIO COMMON CARRIER PAGING 

320 CQD CONQUEST LONG DISTANCE CORPORATION 
321 ATX AT&T-C 

322 ATX AT&T-C 

323 ATX AT&T-C 

324 HNI HOUSTON NETWORKM INC./VXVY TELECOM, INC. 
325 ATX AT&T-C 

326 UTC US TELCOM, INC./US SPRINT 

327 ATX AT&T-C 

328 ATX AT&T-C 

329 ATL ATC 

330 ATL ATC 

331 ATX AT&T-C 

332 ATX AT&T-C 

333 MCI MCI TELECOMMUNICATIONS CORPORATION 
334 ATX AT&T-C 

335 SCH SCHNEIDER COMMUNICATIONS 

336 ATX AT&T-C 

337 FDR FIRST DATA RESOURCES 

338 ATX AT&T-C 

339 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
340 FFM FIRST FINANCIAL MANAGEMENT CORPORATION 
341 ATX AT&T-C 

342 ATX AT&T-C 

343 ATX AT&T-C 

344 ATX AT&T-C 

345 ATX AT&T-C 

346 ATX AT&T-C 

347 UTC US TELCOM, INC./US SPRINT 

348 ATX AT&T-C 

349 DCT DIRECT COMMUNICATIONS, INC. 

350 CSY COM SYSTEMS 
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351 ATX AT&T-C 

352 ATX AT&T-C 

353 SCH SCHNEIDER COMMUNICATIONS 

354 ATX AT&T-C 

355 ATZ ATX-COMMUNICATIONS 

356 ATX AT&T-C 

357 CNZ CAM-NET SYSTEMS-INC. 

358 ATX AT&T-C 

359 UTC US TELCOM, INC./US SPRINT 

360 CWV ? 

361 CAN ELCOM CANADA 

362 ATX AT&T-C 

363 CAN TELCOM CANADA 

364 HNI HOUSTON NETWORKM INC./VXVY TELECOM, INC. 
365 MCI MCI TELECOMMUNICATIONS CORPORATION 
366 UTC US TELCOM, INC./US SPRINT 

367 ATX AT&T-C 

368 ATX AT&T-C 

369 TDD MCI / TELECONNEC 

370 TDD MCI / TELECONNECT 

372 ATX AT&T-C 

373 TDD MCI / TELECONNEC 

374 ITG INTERNATIONAL TELECHARGE, INC. 

375 TNO ATC CIGNAL COMMUNICATIONS 

375 ATL ATC 

376 ECR ECONO-CALL LONG DISTANCE 

377 GTS TELENET COMMUNICATIONS CORPORATION 
378 NTP NATIONAL TELEPHONE COMPANY 

379 EMI EASTERN MICROWAVE 

381 LMI LONG DISTANCE OF MICHIGAN 

382 ATX AT&T-C 

383 TDD MCI / TELECONNECT 

384 FDT FRIEND TECHNOLOGIES 

385 CAB HEDGES COMMUNICATIONS /COM CABLE LAYING 
386 TBO ELECABLE CORPORATION 

387 CAN TELCOM CANADA 

388 MCI MCI TELECOMMUNICATIONS CORPORATION 
390 EBR ECONO-CALL 


393 EXF PIONEER TELEPHONE /EXECULINES OF FLORIDA 
394 TDX CABLE & WIRELESS COMMUNICATIONS 

395 MCI MCI TELECOMMUNICATIONS CORPORATION 

396 BOA BANK OF AMERICA 

397 TDD MCI / TELECONNECT 

399 ARZ AMERICALL CORPORATION (CA) 

402 RCCP RADIO COMMON CARRIER PAGING 

412 RCCP RADIO COMMON CARRIER PAGING 

420 TGR TMC OF SOUTHWEST FLORIDA 

421 ATX AT&T-C 

422 ATX AT&T-C 

423 ATX AT&T-C 

424 ATX AT&T-C 

425 TTH TELE TECH, INC 

426 ATX AT&T-C 

427 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
428 ATX AT&T-C 

429 TRF T-TEL 

431 ATX AT&T-C 

432 ATX AT&T-C 

433 ATX AT&T-C 

434 AGN AMERIGON 

435 ATX AT&T-C 

436 IDN INDIANA SWITCH, INC. 

437 ATX AT&T-C 

438 ATX AT&T-C 

439 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
440 TXN TEX-NET 

441 ATX AT&T-C 
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ATX AT&T-C 
ATX AT&T-C 
MCI MCI TELECOMMUNICATIONS CORPORATION 
ATX AT&T-C 
ATX AT&T-C 
ATX AT&T-C 
ATX AT&T-C 
UTD UNITED TELCO / TELAMAR 
USL US LINK LONG DISTANCE 
ATX AT&T-C 
ATX AT&T-C 
ATX AT&T-C 


ALN ALLNET COMMUNICATIONS SERVICES 
LDG LDD, INC. 
MCI MCI TELECOMMUNICATIONS CORPORATION 


9631 NORTHWEST BELL 


NTX NATIONAL TELEPHONE EXCHANGE 
CAN TELCOM CANADA 

ATX ATs&T-C 

CAN TELCOM CANADA 

NASC 800 NUMBER SERVICE & ASSIGNMENT CENTE 
CAN TELCOM CANADA 

ALN ALLNET COMMUNICATIONS SERVICES 

LDD LDDS COMMUNICATIONS 

ATX ATs&T-C 

IAS IOWA NETWORK SERVICES 

ALN ALLNET COMMUNICATIONS SERVICES 

ATX ATs&T-C 

UTC US TELCOM, INC./US SPRINT 

32V1 VIRGIN ISLAND TELEPHONE 

TDD MCI / TELECONNECT 

SNT MCI / TDD / SOUTHERNNET, INC. 


MCI MCI TELECOMMUNICATIONS CORPORATION 
AAM ALASCOM 


NASC 800 NUMBER SERVICE & ASSIGNMENT CENTE 


1186 GTE/NORTH 
ATX AT&T-C 


0328 GTE/FLORIDA 

TDD MCI / TELECONNECT 

TDD MCI / TELECONNECT 

TDX CABLE & WIRELESS COMMUNICATIONS 
UTC US TELCOM, INC./US SPRINT 
UTC US TELCOM, INC./US SPRINT 
LDD LDDS COMMUNICATIONS 

ATX AT&T-C 

IPC INTERNATION PACIFIC 

NWR NETWORK TELEPHONE SERVICE 
JNT J-NET COMMUNICATIONS 

TRA3 TRAFFIC ROUTING ADMINISTRATION 3 
RCCP RADIO COMMON CARRIER PAGING 
RCCP RADIO COMMON CARRIER PAGING 
PCD PENTAGON COMPUTER DATA, LTD 
ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 

MIT MIDCO COMMUNICATIONS 

VRT VARTEC NATIONAL, INC. 

ATX AT&T-C 

ATX AT&T-C 

ATX AT&T-C 


TRA3 TRAFFIC ROUTING ADMINISTRATION 3 
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535 ATX AT&T-C 

536 ALN ALLNET COMMUNICATIONS SERVICES 
537 ATX AT&T-C 

538 ATX AT&T-C 

539 FNE FIRST PHONE 

540 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
541 ATX AT&T-C 

542 ATX AT&T-C 

543 ATX AT&T-C 

544 ATX AT&T-C 

545 ATX AT&T-C 

546 UTC US TELCOM, INC./US SPRINT 

547 ATX AT&T-C 

548 ATX AT&T-C 

549 CBU CALL AMERICA 

550 CMA CALL-AMERICA 

551 ATX AT&T-C 

552 ATX AT&T-C 

553 ATX AT&T-C 

554 ATX AT&T-C 

555 ATX AT&T-C 

556 ATX AT&T-C 

557 ALN ALLNET COMMUNICATIONS SERVICES 
558 ATX AT&T-C 

561 CAN TELCOM CANADA 

562 ATX AT&T-C 

563 CAN TELCOM CANADA 

564 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
565 CAN TELCOM CANADA 

566 ALN ALLNET COMMUNICATIONS SERVICES 
567 CAN EFLCOM CANADA 

568 MCI MCI TELECOMMUNICATIONS CORPORATION 
569 TEN ELESPHERE NETWORK 

572 ATX AT&T-C 

574 AMM ACCESS LONG DISTANCE 

575 AOI UNITED COMMUNICATIONS, INC. 

577 GTS TELENET COMMUNICATIONS CORPORATION 
579 LNS LINTEL SYSTEMS 

580 WES WESTEL 

582 ATX AT&T-C 

583 TDD MCI / TELECONNECT 

584 TDD MCI / TELECONNECT 

586 ATC ACTION TELECOM COMPANY 

587 LTQ LONG DISTANCE FOR LESS 

588 ATC ACTION TELECOM COMPANY 

589 LGT LITEL 

592 ATX AT&T-C 

593 TDD MCI / TELECONNECT 

594 TDD MCI / TELECONNECT 

595 32P1 PUERTO RICO TELEPHONE 

596 TOI TELECOM "OPTIONS" PLUS, INC. 

599 LDM LONG DISTANCE MANAGEMENT 

602 RCCP RADIO COMMON CARRIER PAGING 

612 RCCP RADIO COMMON CARRIER PAGING 

621 ATX AT&T-C 

622 ATX AT&T-C 

623 TRA3 TRAFFIC ROUTING ADMINISTRATION 3 
624 ATX AT&T-C 

625 NLD NATIONAL DATA CORP 

626 ATX AT&T-C 

627 MCI MCI TELECOMMUNICATIONS CORPORATION 
628 ATX AT&T-C 

629 2284 BEEHIVE TELEPHONE 

631 ATX AT&T-C 

632 ATX AT&T-C 

633 ATX AT&T-C 

634 ATX AT&T-C 

635 ATX AT&T-C 
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636 CQU CONQUEST COMMUNICATION CORPORATION 
637 ATX AT&T-C 

638 ATX AT&T-C 

639 BUR BURLINGTON TEL 

640 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
641 ATX AT&T-C 

642 ATX AT&T-C 

643 ATX AT&T-C 

644 CMA CALL-AMERICA 

645 ATX AT&T-C 

646 UTT UNION TELEPHONE COMPANY 

647 ATX AT&T-C 

648 ATX AT&T-C 

649 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
652 ATX AT&T-C 

654 ATX AT&T-C 

655 ESM EXECULINE OF SACRAMENTO, INC. 

656 AVX AMVOX 

657 TDD MCI / TELECONNECT 

658 TDD MCI / TELECONNECT 

659 UTC US TELCOM, INC./US SPRINT 

660 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
661 CAN ELCOM CANADA 

662 ATX AT&T-C 

663 CAN TELCOM CANADA 

664 MCI MCI TELECOMMUNICATIONS CORPORATION 
665 CAN TELCOM CANADA 

666 MCI MCI TELECOMMUNICATIONS CORPORATION 
667 CAN TELCOM CANADA 

668 CAN ELCOM CANADA 

669 UTC US TELCOM, INC./US SPRINT 

672 ATX AT&T-C 

673 SNT MCI / TDD / SOUTHERNNET, INC. 

674 TDD MCI / TELECONNECT 

675 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
676 UTC US TELCOM, INC./US SPRINT 

677 MCI MCI TELECOMMUNICATIONS CORPORATION 
678 MCI MCI TELECOMMUNICATIONS CORPORATION 
679 VOB TRANS-NET, INC 

680 2408 PACIFIC TELCOM 

682 ATX AT&T-C 

683 MTD METROMEDIA LONG DISTANCE 

684 NTQ NORTHERN TELECOM, INC. 

685 MCI MCI TELECOMMUNICATIONS CORPORATION 
686 LGT LITEL 

687 NTS NTS COMMUNICATIONS 

688 MCI MCI TELECOMMUNICATIONS CORPORATION 
689 NWS NORTHWEST TELCO 

691 32D1 DOMIN REPUBLIC TELEPHONE 

692 ATX AT&T-C 

693 JJJ TRI-d 

694 TZC TELESCAN 

695 MCI MCI TELECOMMUNICATIONS CORPORATION 
696 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
698 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
699 PLG PILGRIM TELEPHONE CO. 

702 RCCP RADIO COMMON CARRIER PAGING 

712 RCCP RADIO COMMON CARRIER PAGING 

720 TGN TELEMANAGEMENT CONSULT’ T CORP 

721 FLX FLEX COMMUNICATIONS 

722 ATX AT&T-C 

723 MCI MCI TELECOMMUNICATIONS CORPORATION 
724 RTC RCI CORPORATION 

725 ATL ATC 

726 UTC US TELCOM, INC./US SPRINT 

727 MCI MCI TELECOMMUNICATIONS CORPORATION 
728 TDD MCI / TELECONNECT 

729 UTC US TELCOM, INC./US SPRINT 
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732 ATX AT&T-C 

733 UTC US TELCOM, INC./US SPRINT 

734 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
735 UTC US TELCOM, INC./US SPRINT 

736 UTC US TELCOM, INC./US SPRINT 

737 MEC MERCURY, INC. 

738 MEC MERCURY, INC. 

741 ATL ATC 

742 ATX AT&T-C 

743 UTC US TELCOM, INC./US SPRINT 

744 TRA3 TRAFFIC ROUTING ADMINISTRATION 3 
745 UIC US TELCOM, INC./US SPRINT 

746 FTC ETC COMMUNICATIONS, INCORPORATION 
747 TDD MCI / TELECONNECT 

748 TDD MCI / TELECONNECT 

749 ATL ATC 

752 ATX AT&T-C 

753 MCI MCI TELECOMMUNICATIONS CORPORATION 
754 TSH EL-SHARE 

755 UTC US TELCOM, INC./US SPRINT 

756 MCI MCI TELECOMMUNICATIONS CORPORATION 
757 TID MC OF SOUTH CENTRAL INDIANA 

759 MCI MCI TELECOMMUNICATIONS CORPORATION 
761 ACX ALTERNATE COMMUNICATIONS TECHNOLOGY 
762 ATX AT&T-C 

763 TON TOUCH & SAVE 

764 AAM ALASCOM 

765 MCI MCI TELECOMMUNICATIONS CORPORATION 
766 MCI MCI TELECOMMUNICATIONS CORPORATION 
767 UTC US TELCOM, INC./US SPRINT 

768 SNT MCI / TDD / SOUTHERNNET, INC. 

770 3300 GENERAL COMMUNICATIONS 

771 SNT MCI / TDD / SOUTHERNNET, INC. 

772 ATX AT&T-C 

773 CUX COMPU-TEL INC. 

774 TTQ TTE OF CHARLESTON 

776 UTC US TELCOM, INC./US SPRINT 

777 MCI MCI TELECOMMUNICATIONS CORPORATION 
778 EDS ELECTRONIC DATA SYSTEMS CORPORATION 
779 TDD MCI / TELECONNECT 

780 SNT MCI / TDD / SOUTHERNNET, INC. 

782 ATX AT&T-C 

783 ALN ALLNET COMMUNICATIONS SERVICES 

784 ALG AMERICAN LONG LINE 

785 SNH SUNSHINE TELEPHONE CO 

786 0341 UNITED/FLORIDA 

787 MAD MID ATLANTIC TELECOM 

788 UTC US TELCOM, INC./US SPRINT 

789 TMU TEL-AMERICA, INC 

792 ATX AT&T-C 

794 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
797 TAM TMC OF SOUTH CENTRAL INDIANA 

798 TDD MCI / TELECONNECT 

800 UTC US TELCOM, INC./US SPRINT 

802 RCCP RADIO COMMON CARRIER PAGING 

807 NTI NETWORK TELECOMMUNICATIONS 

808 AAX AMERITECH AUDIOTEX SERVICES 

812 RCCP RADIO COMMON CARRIER PAGING 

821 ATX AT&T-C 

822 ATX AT&T-C 

823 THA TOUCH AMERICA 

824 ATX AT&T-C 

825 MCI MCI TELECOMMUNICATIONS CORPORATION 
826 ATX AT&T-C 

827 UTC US TELCOM, INC./US SPRINT 

828 ATX AT&T-C 

829 UTC US TELCOM, INC./US SPRINT 

831 ATX AT&T-C 
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832 ATX AT&T-C 

833 ATX AT&T-C 

834 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
835 ATX AT&T-C 

836 TDD MCI / TELECONNECT 

837 TDD MCI / TELECONNECT 

838 0567 UNITED/INT MN 

839 VST STAR-LINE 

841 ATX AT&T-C 

842 ATX AT&T-C 

843 ATX AT&T-C 

844 LDD LDDS COMMUNICATIONS 

845 ATX AT&T-C 

846 MCI MCI TELECOMMUNICATIONS CORPORATION 
847 ATX AT&T-C 

848 ATX AT&T-C 

849 BTM BUSINESS TELECOM, INC. 

850 TKC TK COMMUNICATIONS 

851 ATX AT&T-C 

852 ATX AT&T-C 

853 UTY UNIVERSAL COMMUNICATIONS 

854 ATX AT&T-C 

855 ATX AT&T-C 

857 TDD MCI / TELECONNECT 

858 ATX AT&T-C 

860 VNS VIRTUAL NETWORK 

862 ATX AT&T-C 

863 ALN ALLNET COMMUNICATIONS SERVICES 

864 TEN TELESPHERE NETWORK 

865 3100 HAWAIIAN TELEPHONE 

866 MCI MCI TELECOMMUNICATIONS CORPORATION 
867 RBL VORTEI 

868 SNT MCI / TDD / SOUTHERNNET, INC. 

869 UTC US TELCOM, INC./US SPRINT 

871 TXL DIGITAL NETWORK, INC. 

872 ATX AT&T-C 

873 MCI MCI TELECOMMUNICATIONS CORPORATION 
874 ATX AT&T-C 

875 ALN ALLNET COMMUNICATIONS SERVICES 

876 MCI MCI TELECOMMUNICATIONS CORPORATION 
877 UTC US TELCOM, INC./US SPRINT 

878 ALN ALLNET COMMUNICATIONS SERVICES 

879 MCI MCI TELECOMMUNICATIONS CORPORATION 
880 NTV NATIONAL TELECOMMUNICATIONS 

881 NTV NATIONAL TELECOMMUNICATIONS 

882 ATX AT&T-C 

883 TDX CABLE & WIRELESS COMMUNICATIONS 
884 UTC US TELCOM, INC./US SPRINT 

885 SDY TELVUE, CORP 

886 ALN ALLNET COMMUNICATIONS SERVICES 

887 ETS EASTERN TELEPHONE SYSTEMS, INC. 
888 MCI MCI TELECOMMUNICATIONS CORPORATION 
889 2408 PACIFIC TELCOM 

890 ATZ ATX-COMMUNICATIONS 

891 TVT MC COMMUNICATIONS 

892 ATX AT&T-C 

896 TXN EX-NET 

898 CGI COMMUNICATIONS GROUP OF JACKSON 
899 TDX CABLE & WIRELESS COMMUNICATIONS 
902 RCCP RADIO COMMON CARRIER PAGING 

908 AAX AMERITECH AUDIOTEX SERVICES 

912 RCCP RADIO COMMON CARRIER PAGING 

922 ATX AT&T-C 

923 ALN ALLNET COMMUNICATIONS SERVICES 

924 NASC 800 NUMBER SERVICE & ASSIGNMENT CENTER 
925 MCI MCI TELECOMMUNICATIONS CORPORATION 
926 MCI MCI TELECOMMUNICATIONS CORPORATION 
927 UTC US TELCOM, INC./US SPRINT 
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928 ALU AMERICALL SYSTEMS - LOUISIANNA 


933 MCI MCI TELECOMMUNICATIONS CORPORATION 
934 MCI MCI TELECOMMUNICATIONS CORPORATION 
936 RBW R-COMM 

937 MCI MCI TELECOMMUNICATIONS CORPORATION 
939 TZX TELENATIONAL COMMUNICATIONS 

940 TSF ATC / SOUTH TEL 

942 ATX AT&T-C 

943 AUU AUS, INC. 

944 MCI MCI TELECOMMUNICATIONS CORPORATION 
945 MCI MCI TELECOMMUNICATIONS CORPORATION 
946 API PHONE ONE — AMERICAN PIONEER TELEPHONE 
947 MCI MCI TELECOMMUNICATIONS CORPORATION 
948 PHX PHOENIX NETWORK 

950 MCI MCI TELECOMMUNICATIONS CORPORATION 
951 BML PHONE AMERICA 

952 ATX AT&T-C 

955 MCI MCI TELECOMMUNICATIONS CORPORATION 
960 CNO COMTEL OF NEW ORLEANS 

962 ATX AT&T-C 

963 SOC STATE OF CALIFORNIA 

964 MCI MCI TELECOMMUNICATIONS CORPORATION 
965 TLX TMC OF LEXINGTON 

966 TDX CABLE & WIRELESS COMMUNICATIONS 
967 MCI MCI TELECOMMUNICATIONS CORPORATION 
968 TED TELEDIAL AMERICA 

969 TDX CABLE & WIRELESS COMMUNICATIONS 
972 ATX AT&T-C 

980 VLW VALU-LINE OF LONGVIEW, INC. 

981 32P1 PUERTO RICO TELEPHONE 

982 ATX AT&T-C 

983 WUT WESTERN UNION TELEGRAPH CO. 

986 WU WESTERN UNION TELEGRAPH CO. 

987 BTL BITTEL TELECOMMUNICATIONS CORPORATION 
988 TDD MCI / TELECONNECT 

989 TDX CABLE & WIRELESS COMMUNICATIONS 
990 FEB FEB CORPORATION 


996 VOA VALU-LINE 
999 MCI MCI TELECOMMUNICATIONS CORPORATION 


8.txt Wed Apr 26 09:43:39 2017 1 


==Phrack Inc.== 


Volume Four, Issue Thirty-Nine, File 8 of 13 


Air Fone Frequencies 
by Leroy Donnelly 
Leroy.Donnelly@IVGATE.OMAHUG.ORG 


his is a quick file on the subject of what frequencies are used for Air Fone 
lephone while in-flight air-to-ground. The following should give you some an 
understanding of how it all works. 


The FCC has issued rules on allocation of the 849-851/894-895 MHz bands for 
air-ground radiotelephone servic 


The most recent action was effective September 9, 1991: 


= 


1) Changed channel spacing from GTE Airfone Inc.’s de facto standards; 


2) Ordered GTE to make its service available to other air-ground licensees 
at non-discriminatory rates; 


3) Divided each channel block into 6 control channels (P-1 through P-6) 
and 29 communications channels (C-1 through C-29); 


4) Provided for a communications channel bandwidth of 6 kHz; 


5) Gave GTE 22 months to modify its current control channel scheme; during 
this period, GTE can use the lower 20 kHz of each channel block, which 
includes channels C-1, C-2, and C-3, for control. GTE then has another 

38 months during which it can only use a 3.2 kHz control channel in 

channel C-2 of each channel block. After these transition periods end 

(September of 1996), GTE must switch to control channels marked P-1 


through P-6 in the tables below; 


6) Empowered the FCC to assign exclusively one control channel to each 
air-ground licensee; 


7) Limited the ERP of airborne stations to 30 watts maximum; and that of 
ground stations to 100 watts maximum; 


8) Limited the ERP of ground stations to 1 watt when communicating with 
aircraft on the ground. 


GROUND TO AIR CHANNELS 


(NOTE: "GB" in these listings denotes Guard Band, a series of 3 kHz spacings 
to separate communications channels from control channels.) 


CH. # CHANNEL BLOCK 
10 9 8 7 6 

C-1 849.0055 849.2055 849.4055 849.6055 849.8055 
€=2 849.0115 849.2115 849.4115 849.6115 849.8115 
€=3 849.0175 849.2175 849.4175 849.6175 849.8175 
c-4 849.0235 849.2235 849.4235 849.6235 849.8235 
E-5 849.0295 849.2295 849.4295 849.6295 849.8295 
C-6 849.0355 849.2355 849.4355 849.6355 849.8355 
C-7 849.0415 849.2415 849.4415 849.6415 849.8415 
C-8 849.0475 849.2475 849.4475 849.6475 849.8475 
C-9 849.0535 849.2535 849.4535 849.6535 849.8535 
C-10 849.0595 849.2595 849.4595 849.6595 849.8595 
Caid 849.0655 849.2655 849.4655 849.6655 849.8655 
E-1:2 849.0715 849.2715 849.4715 849.6715 849.8715 
€=13 849.0775 849.2775 849.4775 849.6775 849.8775 
c-14 849.0835 849.2835 849.4835 849.6835 849.8835 


850.1 
850.1 
850.1 
850.1 


CaS 84 
C-16 84 
€-17 84 
C-18 84 
€-19 84 
C-20 84 
C-21 84 
C-22 84 
€=23 84 
C-24 84 
€-25 84 
C-26 84 
C-27 84 
C-28 84 
C-29 84 
GB 84 

84 
P-6 84 
P= 84 
P-4 84 
P-3 84 
Pa2 84 
Pay 84 
Cai 850. 
€=2 850. 
€=3 850. 
Cc-4 850. 
C=5 850. 
C-6 850. 
Ce: $5.0; 
C-8 850. 
C-9 850. 
C-10 850. 
Cai 850. 
e=12 850. 
€=1:3 850. 
c-14 850. 
C=15 850. 
C-16 850. 
C-1} 
C-18 
C-19 
C-20 850.1 
C-21 850.1 
C-22 850.1 
C=23 850.1 
C-24 850.1 
C-25 850.1 
C-26 850.1 
C-27 850.1 
C-28 850.1 
C-29 850.1 
GB 850.1 
P-6 
P=) 
P-4 
P= 3, 850.1 
P=2 
Pa 


AIR TO GROUND 


OODODMOOMOWOOWOMOMOWMOW WO WO WO 


OWOOWMWO OO OO 


850.1 
850.1 
850.1 


850.1 
850.1 


-0895 
.0955 
1015 
1075 
dbIleS eo) 
1195 
1255 
1315 
1375 
1435 
1495 
1555 
1615 
1675 
LY 
1765 
to 
1797 
1813 
1845 
1877 
1909 
1941 
1973 


CHANNI 


84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 


OMOMOMOOMOWOOWMOMOWOW WO WO WO 


84 
84 
84 
84 
84 
84 
84 


OWOOWMOWO WO WO 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 


850. 
850. 
850. 
850. 
850. 
850. 
850. 


ELS 


to 


eSl97 
3813 
3845 
.3877 
3909 
~3941 
3973 


84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 


OOMDMOOMOWOOWOMOMOWOWO WO WO WO 


84 
84 
84 
84 
84 
84 
84 


OWOOMO WOO WO 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
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~2895 
-2855 
3015 
3075 
.3135 
3195 
#3255 
3315 
«33:15 
3435 
3495 
33999 
3615 
3675 
3735 
3765 


-4895 
-4955 
~5015 
-5075 
~9135 
-5195 
»5255 
O35 
293-19 
-5435 
~5495 
29599 
-5615 
-5675 
-5735 
-5765 


to 


.5797 
5813 
-5845 
-5877 
-5909 
~5941 
Poole ares) 


84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 


84 
84 
84 
84 
84 
84 
84 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 


850. 
850. 
850. 
850. 
850. 
850. 
850. 


OMOMDOMOOMOMOWOOWOMOMOWOW WO WO WO 


OWOOWMOWO OO WO 


84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
84 
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84 
84 
84 
84 
84 
84 
84 


OWOOWO WOO WO 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 
850. 


850. 
850. 
850. 
850. 
850. 
850. 
850. 
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894. 
894. 
894. 
894. 
894. 
894. 
894. 
894. 
894, 
894, 
894. 
894. 
894. 
894, 
894. 
894. 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 


894.1 
894.1 
894.1 
894.1 
894.1 
894.1 
894.1 


895%: 
895. 
895. 
895. 
895. 
895% 
895. 
895. 
895. 
895. 
895. 
8.95 
895. 
895. 
895. 
895. 
895.1 
895.1 
895.1 
895.1 
895.1 
895.1 
895.1 
895.1 


894, 
894. 
894. 
894. 
894, 
894, 
894. 
894. 
894. 
894. 
894. 
894, 
894. 
894. 
894. 
894. 
894. 
894, 
894, 
894, 
894. 
894. 
894. 
894. 
894, 
894. 
894. 
894. 
894. 
894. 


894. 
894, 
894. 
894. 
894. 
894. 
894. 


895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
899: 
8.95.; 
899% 
895. 
895. 
895. 


CHANNEL BLOCK 
8 
894.4055 894. 
894.4115 894. 
894.4175 894. 
894.4235 894. 
894.4295 894. 
894.4355 894. 
894.4415 894. 
894.4475 894. 
894.4535 894. 
894.4595 894. 
894.4655 894. 
894.4715 894. 
894.4775 894. 
894.4835 894. 
894.4895 894. 
894.4955 894. 
894.5015 894. 
894.5075 894. 
894.5135 894, 
894.5195 894. 
894.5255 894. 
894.5315 894. 
894.5375 894. 
894.5435 894. 
894.5495 894. 
894.5555 894. 
894.5615 894. 
894.5675 894. 
894.5735 894. 
894.5765 894. 
to 
894.5797 894. 
894.5813 894. 
894.5845 894. 
894.5877 894. 
894.5909 894. 
894.5941 894. 
894.5973 894. 
3 
895.4055 895. 
895.4115 895. 
895.4175 895. 
895.4235 895. 
895.4295 895. 
895.4355 895. 
895.4415 895. 
895.4475 895. 
895.4535 895. 
895.4595 895. 
895.4655 895. 
895.4715 895. 
895.4775 895. 
895.4835 895. 
895.4895 895. 
895.4955 895. 
895.5015 895. 
895:.50:15" -895:, 
895.,513.5: -8.95.. 
895.5195 895. 
895.5255 895. 
895.5315 895. 
895.53 715: 895: 
895.5435 895. 


894, 
894. 
894. 
894. 
894. 
894. 
894, 
894. 
894. 
894. 
894. 
894, 
894. 
894, 
894. 
894. 
894. 
894. 
894. 
894. 
894. 
894. 
894, 
894, 
894. 
894, 
894. 
894. 
894. 
894. 


894. 
894. 
894. 
894. 
894, 
894. 
894. 


8:95.% 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
895. 
8:9'5.3 
895. 
895. 
895. 
895. 
895< 
895. 
895. 
895. 
895. 
895. 
895.6 
895. 


CH25) 895.1495 
C=26 895.1555 
C-27 895.1615 
C-28 895.1675 
Ca29 895.1735 
GB 895.1765 
to 

895.1797 

P-6 895.1813 
P=5 895.1845 
P-4 895.1877 
P-3 895.1909 
P-2 895.1941 
P-1 895.1973 


GEOGRAPHICAL CHANN 


895. 
895. 
895. 
895. 
8.95:; 
895% 
895. 


(Ground stations using the same channel 


LOCATION 
ALASKA 
Anchorage 
Cordova 
Ketchikan 
Juneau 
Sitka 
Yakutat 
ALABAMA 
Birmingham 
ARIZONA 
Phoenix 
Winslow 
ARKANSAS 
Pine Bluff 
CALIFORNIA 
Blythe 
Eureka 
Los Angeles 
Oakland 
S. San Fran. 
Visalia 
COLORADO 


Colorado Spgs. 


Denver 

Hayden 
FLORIDA 

Miami 

Orlando 

Tallahassee 
GEORGIA 

Atlanta 

St. 
HAWAII 

Mauna Kapu 
IDAHO 

Blackfoot 

Caldwell 
ILLINOIS 

Chicago 

Kewanee 

Schiller Park 
INDIANA 

Fort Wayne 
IOWA 

Des Moines 
KANSAS 

Garden City 


Simons Is. 


3495 
3555 
3615 
3675 
3735 
3765 
to 
3797 
3813 
3845 
3877 
3909 
3941 
3973 


895. 
895. 
895. 
Saehows 
895. 
895. 


895. 
895. 
895. 
895. 
895. 
809% 
895. 


EL BLOCK LAYOUT 


CH. BLOCK 


ones oO wo 
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895. 
895. 
395% 
895. 
895. 
895. 


5495 
D000 
5615 
5675 
S135 
S165 
to 
5797 
5813 
5845 
5877 
5909 
5941 
5973 


4 
895.7495 895. 
895.7555 895. 
895.7615 895. 
895.7675 895. 
8995, L139. 78 95% 
895.7765 895. 

to 
895.7797 895. 
895.7813 895. 
895.7845 895. 
895.7877 895. 
895.7909 895. 
895.7941 895. 
895.7973 895. 


block must be 


9495 
9555 
9615 
9675 
9735 
9765 
to 
9797 
9813 
9845 
9877 
9909 
9941 
9973 


at least 300 miles apart) 
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Wichita 7 
KENTUCKY 

Fairdale 6 
LOUISIANA 

Kenner 3 

Shreveport D: 
MASSACHUSETTS 

Boston 7 
MICHIGAN 

Bellville 8 

Flint 9 

Sault S. Marie 6 
MINNESOTA 

Bloomington 9 
MISSISSIPPI 

Meridian 9 
MISSOURI 

Kansas City 6 

St. Louis 4 

Springfield 9 
MONTANA 

Lewistown 5 

Miles City 8 

Missoula 3 
NEBRASKA 

Grand Island 2 

Ogallala 4 
NEVADA 

Las Vegas 1 

Reno 3 

Tonopah 9 

Winnemucca 4 
NEW MEXICO 

Alamogordo 8 

Albuquerque 10 

Aztec 9 

Clayton 5 
NEW JERSEY 

Woodbury 3 
NEW YORK 

E. Elmhurst 1 

Schuyler 2 


Staten Island 9 


NORTH CAROLINA 
Greensboro 9 
Wilmington 3 

NORTH DAKOTA 
Dickinson 7 

OHIO 
Pataskala if 

OKLAHOMA 
Warner 4 
Woodward 9 

OREGON 
Albany 5 
Klamath Falls 2 
Pendleton 7 

PENNSYLVANIA 
Coraopolis 4 


New Cumberland 8 


SOUTH CAROLINA 
Charleston 4 
SOUTH DAKOTA 
Aberdeen 6 
Rapid City 5 
TENNESSEE 


Elizabethton 7 
Memphis 10 
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Nashville 3 
TEXAS 

Austin 2 

Bedford il 

Houston 9 

5 

6 


Lubbock 
onahans 
UTAH 
Abajo Peak ui 
Delta 2 
Escalante iS) 

3 

1 


Green River 
Salt Lake City 
VIRGINIA 
Arlington 6 
WASHINGTON 

Seattle 4 

Cheney 1 
WEST VIRGINIA 

Charleston 2 
WISCONSIN 

Stevens Point 8 
WYOMING 

Riverton 9 
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THE OPEN BARN DOOR 


U.S. Firms Face A Wave Of Foreign Espionage 


By Douglas Waller 
Newsweek, May 4, 1992, Page 58 


It’s tough enough these days for American companies to compete with their 
Pacific Rim rivals, even when the playing field is level. It’s a lot tougher 
when your trade secrets are peddled by competitors. One Dallas computer 
maker, for example, recently spotted its sensitive pricing information in the 
bids of a South Korean rival. The firm hired a detective agency, Phoenix 
Investigations, which found an innocent-looking plastic box in a closet at its 
headquarters. Inside was a radio transmitter wired to a cable connected to a 
company fax machine. The bug had been secretly installed by a new worker -- a 
mole planted by the Korean company. "American companies don’t believe this 
kind of stuff can happen," says Phoenix president Richard Aznaran. "By the 
time they come to us the barn door is wide open." 


Welcome to a world order where profits have replaced missiles as the 
currency of power. Industrial espionage isn’t new, and it isn’t always 
illegal, but as firms develop global reach, they are acquiring new 
vulnerability to economic espionage. In a survey by the American Society for 
Industrial Security last year, 37 percent of the 165 U.S. firms responding said 
they had been targets of spying. The increase has been so alarming that both 
the CIA and the FBI have beefed up their economic counterintelligence programs. 
The companies are mounting more aggressive safeguards, too. Kellog Company has 
halted public tours at its Battle Creek, Michigan, facility because spies wer 


slipping in to photograph equipment. Eastman Kodak Company classifies 
documents, just like the government. Lotus Development Corporation screens 
cleaning crews that work at night. "As our computers become smaller, it’s 


easier for someone to walk off with one," says Lotus spokesperson Rebecca Seel. 


To be sure, some U.S. firms have been guilty of espionage themselves 
though they tend not to practice it overseas, because foreign companies have a 
tighter hold on their secrets. And American companies now face an additional 
hazard: The professional spy services of foreign nations. "We’re finding 
intelligence organizations from countries we’ve never looked at before who are 
active in the U.S.," says the FBI’s R. Patrick Watson. Foreign intelligence 
agencies traditionally thought friendly to the United States "are trying to 
plant moles in American high-tech companies [and] search the briefcases of 
American business men traveling overseas," warns CIA Director Robert Gates. 
Adds Noell Matchett, a former National Security Agency official: "What we’ve 
got is this big black hole of espionage going on all over the world and a naive 
set of American business people being raped." 


No one knows quite how much money U.S. businesses lost to this black hole. 
Foreign governments refuse to comment on business intelligence they collect. 
The victims rarely publicize the espionage or report it to authorities for fear 
of exposing vulnerabilities to stockholders. But more than 30 companies and 
security experts NEWSWEEK contacted claimed billions of dollars are lost 
annually from stolen trade secrets and technology. This week a House Judiciary 
subcommittee is holding hearings to assess the damage. IBM, which has been 
targeted by French and Japanese intelligence operations, estimates $1 billion 
lost from economic espionage and software piracy. IBM won’t offer specifics, 
but says that the espionage "runs the gamut from items missing off loading 
docks to people looking over other people’s shoulders in airplanes." 


Most brazen: France’s intelligence service, the Direction Generale de la 
Securite Exterieure (DGSE), has been the most brazen about economic espionage, 
bugging seats of businessmen flying on airliners and ransacking their hotel 
rooms for documents, say intelligence sources. Three years ago the FBI 


a 


delivered private protests to Paris after it discovered DGSE agents trying to 
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infiltrate European branch offices of IBM and Texas Instruments to pass secrets 
to a French competitor. The complaint fell on deaf ears. The French 
intelligence budget was increased 9 percent this year, to enable the hiring of 
1,000 new employees. A secret CIA report recently warned of French agents 


roaming the United States looking for business secrets. Intelligence sources 
say the French Embassy in Washington has helped French engineers spy on the 
stealth technology used by American warplane manufacturers. "American 


businessmen who stay in Paris hotels should still assume that the contents of 
their briefcases will be photocopied," says security consultant Paul Joyal. 
DGSE officials won’t comment. 


The French are hardly alone in business spying. NSA officials suspect 
British intelligence of monitoring the overseas phone calls of American firms. 
Investigators who just broke up a kidnap ring run by former Argentine 
intelligence and police officials suspect the ring planted some 500 wiretaps on 
foreign businesses in Buenos Aires and fed the information to local firms. The 
Ackerman Group Inc., a Miami consulting firm that tracks espionage, recently 
warned clients about Egyptian intelligence agents who break into the hotel 
rooms of visiting execs with "distressing frequency." 


How do the spies do it? Bugs and bribes are popular tools. During a 
security review of a U.S. manufacturer in Hong Kong, consultant Richard 
Hefferman discovered that someone had tampered with the firm’s phone-switching 
equipment ina closet. He suspects that agents posing as maintenance men 
sneaked into the closet and reprogrammed the computer routing phone calls so 
someone outside the building -- Heffernan never determined who -- could listen 
in simply by punching access codes into his phone. Another example: After 
being outbid at the last minute by a Japanese competitor, a Midwestern heavy 
manufacturer hired Parvus Company, a Maryland security firm made up mostly of 
former CIA and NSA operatives. Parvus investigators found that the Japanese 
firm had recruited one of the manufacturer’s midlevel managers with a drug 
habit to pass along confidential bidding information. 


Actually, many foreign intelligence operations are legal. "The science 
and technology in this country is theirs for the taking so they don’t even have 
to steal it," says Michael Sekora of Technology Strategic Planning, Inc. Take 


company newsletters, which are a good source of quota data. With such 
information in hand, a top agent can piece together production rates. 

American universities are wide open, too: Japanese engineers posing as students 
feed back to their home offices information on school research projects. 

"Watch a Japanese tour team coming through a plant or convention," says Robert 
Burke with Monsanto Company. "They video everything and pick up every sheet of 
paper." 


Computer power: In the old days a business spy visited a bar near a plant 
to find loose-lipped employees. Now all he needs is a computer, modem and 
phone. There are some 10,000 computer bulletin boards in the United States -- 
informal electronic networks that hackers, engineers, scientists and 
government bureaucrats set up with their PCs to share business gossip, the 
latest research on aircraft engines, even private White House phone numbers. 


An agent compiles a list of key words for the technology he wants, which 
trigger responses from bulletin boards. Then, posing as a student wanting 
information, he dials from his computer the bulletin boards in a city where 
the business is located and "finds a Ph.D. who wants to show off," says Thomas 
Sobczak of Application Configured Computers, Inc. Sobczak once discovered a 
European agent using a fake name who posed questions about submarine engines to 
a bulletin board near Groton, Connecticut. The same questions, asked under a 
different hacker’s name, appeared on bulletin boards in Charleston, South 
Carolina, and Bremerton, Washington. Navy submarines are built or based at all 
three cities. 


Using information from phone intercepts, the NSA occasionally tips off 
U.S. firms hit by foreign spying. In fact, Director Gates has promised he’11l 
do more to protect firms from agents abroad by warning them of hostile 
penetrations. The FBI has expanded its economic counterintelligence program. 
The State Department also has begun a pilot program with 50 Fortune 500 
companies to allow their execs traveling abroad to carry the same portable 
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secure phones that U.S. officials use. 


But U.S. 


agencies are still groping for a way to join the business spy 


war. The FBI doesn’t want companies to have top-of-the-lin nceryption devices 
for fear the bureau won’t be able to break their codes to tap phone calls in 


criminal 


investigations. And the CIA is moving cautiously because many of the 


foreign 


protectio 


Carver. 


intelligence services "against whom you’re going to need the most 
n tend to be its closest friends," says former CIA official George 
Even American firms are leery of becoming too cozy with their 


government’s agents. But with more foreign spies coming in for the cash, 
American companies must do more to protect their secrets. 


MONEY TALKS 


How the Spies Do It 


Corporate predators haven’t exactly been shy about greasing a few palms. 


In som 


others, 


cases they glean information simply by bribing American employees. In 
they lure workers on the pretense of hiring them for an important job, 


only to spend the interview pumping them for information. If all else fails, 


the spies simply hire th mployees away to get at their secrets, and chalk it 
all up to the cost of doing business. 


STOP, LOOK, LISTEN 


A wealth of intelligence is hidden in plain sight -- right inside public 
records such as stockholder reports, newsletters, zoning applications and 
regulatory filings. Eavesdropping helps, too. Agents can listen to execs’ 
airplane conversations from six seats away. Some sponsor conferences and 
invite engineers to present papers. Japanese businessmen are famous for 
vacuuming up handouts at conventions and snapping photos on plant tours. 


BUGS 


Electronic transmitters concealed inside ballpoint pens, pocket 


calculators and even wall paneling can broadcast conversations in sensitive 


meetings. 


switchi 


Spies can have American firms’ phone calls rerouted from the 


ng stations to agents listening in. Sometimes, they tap cables attached 
to fax machines. 


HEARTBR 


BAK HOT! 


EL 
Ei 


Planning to leave your briefcase back at the hotel? The spooks will love 


you. O 


ne of t 


heir ploys is to sneak into an room, copy documents and pilfer 


computer disks. Left your password sitting around? Now they have entry to 
your company’s entire computer system. 
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To Some Hackers, Right And Wrong Don’t Compute May 11, 1992 


By Bruce V. Bigelow (San Diego Union-Tribune) 


= 


Special Thanks to Ripper of HALE 


The telephone call was anonymous, and the young, male voice was chatty and 
nonchalant. He wanted to explain a few things about hacking, the black art of 
tapping into private computers. 


He was one of several hackers to call, both frightened and intrigued by a San 
Diego police investigation into an informal network of computer criminals using 
high-tech methods to make fraudulent credit-card purchases. Detectives hav 
seized a personal computer and other materials, and arrests are pending in San 
Diego and other parts of the country. 


"Half the time, it’s feeding on people’s stupidity," the anonymous hacker 
said, boasting that most computers can be cracked as easily as popping a beer. 


Hackers seem full of such bravado. In their electronic messages and in 
interviews, they exaggerate and swagger. 


One message traveling the clandestine network notes: "This text file contains 
extremely damaging material about the American Express account making 
algorithm. I do not commit credit card fraud. I just made up this scheme 


because I was bored. 
They form groups with names like "Legion of Doom" and "Masters of Deception," 
and give themselves nicknames like Phiber Optik, Video Vindicator and Outlaw. 
They view themselves as members of a computer underground, rife with cat-and- 
mouse intrigue. 


For the most part, they are bring teenagers who are coming of age ina 
computer-crazy world. Perhaps a generation ago, they tested their anti- 
authoritarian moxie by shoplifting or stripping cars. But, as it has with 
just about everything else, the computer has made teenage rebellion easier. 


Nowadays, a teenager tapping on a keyboard in the comfort of his bedroom can 
trespass on faraway corporate computers, explore credit files and surf coast-— 
to-coast on long-distance telephone lines. 


San Diego police say that gathering details from computerized files as credit- 
reporting agencies, hackers around the country have racked up millions of 
dollars in fraudulent charges -- a trick known as "carding." 


Conventual notions of right and wrong seem to go fuzzy in th thereal realm 
that hackers call cyberspace, and authorities say the number of crimes 
committed by computer is exploding nationwide. 


Like many hackers, the callers says he’s paranoid. He won’t give his name and 
refuses to meed in person. Now a college student in San Diego, he says, he 


began hacking when he was 13, collecting data by computer like a pack rat. 


"I wanted to know how to make a bomb," he said with a laugh. 
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Like other hackers, he believes their strange underground community is 
misunderstood and maligned. Small wonder. 


They speak a specialized jargon of colons, slashes and equal signs. They work 
compulsively sometimes obsessively to decipher and decode, the hacker 
equivalent of breaking and entering. They exploit loopholes and flaws so they 
can flaunt their techno-prowess. 


"The basis of worth is what you know," the hacker says. "You'll hear the term 
‘lame’ slung around a lot, especially if someone can’t do too much." 


They exchange credit-card numbers by electronic mail and on digital bulletin 
boards set up on personal computers. They trade computer access codes, 
passwords, hacking techniques and other information. 


But it’s not as if everyone is a criminal, the anonymous hacker says. What 
most people don’t realize, he say, is how much information is out there -—- 
"and some people want things for free, you know?" 


The real question for a hacker, he says, is what you do with the information 
once you’ve got it. For some, restraint is a foreign concept. 


RICH IN LORE 


Barely 20 years old, the history of hacking already is rich in lore. 


For example, John Draper gained notoriety by accessing AT&T long distance 
telephone lines for free by blowing a toy whistle from a bod of Cap’n Crunch 
cereal into the telephone. 


Draper, who adopted "Captain Crunch" as his hacker nickname, improved on the 
whistle with an electronic device that duplicated the flute like, rapid-fire 
pulses of telephone tones. 


Another living legend among hackers is a New York youth known as "Phiber 
Optik." 


"The guy has got a photographic memory,’ said Craig Neidorf of Washington, who 
co-founded an underground hacker magazine called Phrack. "He knows everything. 
He can get into anything." 


Phiber Optik demonstrated his skills during a conference organized by Harper’s 
Magazine, which invited some of the nation’s best hackers to "log on" and 
discuss hacking in an electronic forum. Harper’s published a transcript of the 
11-day discussion in it’s March 1990 issue. 


One of the participants, computer expert John Perry Barlow, insulted Phiber 
Optik by saying some hackers are distinguished less by their intelligence than 
by their alienation. 


"Trade their modems for skateboards and only a slight conceptual shift would 
occur," Barlow tapped out in his message. 


Phiber Optik replied 13 minutes later by transmitting a copy of Barlow’s 
personal credit history, which Harper’s editors noted apparently was obtained 
by hacking into TRW’s computer records. 


For people like Emmanuel Goldstein, true hacking is like a high-tech game of 
chess. The game is in the mind, but the moves are played out across a vast 
electronic frontier. 


"You’re not going to stop hackers from trying to find out things," said 
Goldstein, who publishes 2600 Magazine, the hacker quarterly, in Middle 
Island, New York. 


"We're going to be trying to read magnetic strips on cards," Goldstein said. 
"We’re going to try to figure out how password schemes work. That’s not 
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going to change. What has to change is the security measures that companies 
have to take." 


ANGELHEADED HIPSTERS 


True hackers s themselves, in the words of poet Allen Ginsberg, as 
"Angelheaded hipsters burning for the ancient heavenly connection to the 
starry dynamo in the machinery of night." These very words were used by Lee 


Felsenstein, designer of the Osborne-1 computer and co-founder of the Homebrew 
Computer Club. 


But security consultants and law enforcement officials say malicious hackers 
can visit havoc upon anyone with a credit card or driver’s license. 


"Almost none of it, I would say less than 10 percent, has anything to do with 
intellectual exploration," said Gail Thackeray, a Phoenix prosecutor who has 
specialized in computer crimes. "It has to do with defrauding people and 
getting stuff you want without paying for it." 


Such crimes have mushroomed as personal computers have become more affordable 
and after the break up of AT&T made it more difficult to trace telephone calls, 
Thackeray said. 


Even those not motivated by financial gain show a ruthlessness to get what they 
want, Thackeray said. 


"They’1l say the true hacker never damages the system he’s messing with," 
Thackeray said, "but he’s willing to risk it." 


Science-fiction writer Bruce Sterling said he began getting anonymous calls 
from hackers after an article he wrote about the "CyberView 91" hacker 
convention was published in Details Magazine in October. 


The caller’s were apparently displeased with Sterling’s article, which noted, 
among other things, that the bustling convention stopped dead for the season’s 
final episode of "Star Trek: The Next Generation." 


"They were giving me some lip," Sterling said. They showered him with 
invective and chortled about details from Sterling’s personal credit history, 
which they had gleaned by computer. 


They also gained access to Sterling’s long distance telephone records, and 
made abusive calls to many people who has spoken to Sterling. 


"Most of the news stories I read simplify the problem to the point of saying 
that a hacker is a hacker is a hacker," said Donn Parker, a computer security 
consultant with SRI International in Menlo Park. 


"In real life, what we’re dealing with is a very broad spectrum of 
individuals," Parker says. "It goes all the way from 14-year olds playing 
pranks on their friends to hardened juvenile delinquents, career criminals and 
international terrorists." 


Yet true hackers have their own code of honor, Goldstein says. Computer 
trespassing is OK, for example, but altering or damaging the system is wrong. 


Posing as a technician to flim-flam access codes and passwords out of 
unsuspecting computers users is also OK. That’s called "social engineering." 


"They’re simply exploring with what they’ve got, weather it’s exploring a 
haunted house or tapping into a mainframe," Goldstein said. 


"Once we figure things out, we share the information, and of course there are 
going to be those people that abuse that information," Goldstein added. 


It is extremely easy to break into credit bureau computers, Goldstein says. 
But the privacy being violated belongs to individual Americans -- not credit 
bureaus. 
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credit bureaus should be held accountable for not providing 
Goldstein argues. 


Companies Fall Victim To Massive PBX Fraud April 20, 1992 
By Barbara E. McMullen & John F. McMullen (Newsbytes) 
NEW YORK CITY -- Appearing on the WBAI radio show "Off The Hook," New York 


State Police senior investigator Donald Delaney discussed th 
organized crime groups into telecommunications fraud and warned the public 


of the dangers of such practices as 
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or actually try to charge for the connection to the 800 numbers. 


"We’ve even found COCOTs that, on collect calls, put the charges through when 
an answering machine picks up and the caller hangs up after realizing that no 
one is home. They are set up to start billing if a human voice is heard and the 
caller doesn’t hang up within 5 or 10 seconds." 


Delaney agreed that the COCOTS that behave in this fashion are an ongoing 
problem for unsuspecting users, but said that he has received no complaints 
about illegal behavior. He said, however, that he had received complaints 
about fraudulent operation of 540 numbers -- the local New York equivalent of a 
900 number. He said "most people don’t realize that a 540 number is a 
chargeable number and these people fall victim to these scams. We had one case 
in which a person had his computer calling 8,000 phone numbers in the beeper 
blocks each night. The computer would send a 540 number to the beepers. 

People calling the number would receive some innocuous information and, at the 
end of the month a $55 charge on her/his telephone bill." 


Delaney continued, "The public has much to be worried about related to 
telephone fraud, particularly in New York City which can be called "Fraud 
Central, USA." If you go into the Port Authority Bus Terminal and look up in 
the balcony, you will see rows of people "shoulder surfing" with binoculars. 
They have binoculars or telescopes trained on the public telephones. When they 
see a person making a credit card call, they repeat the numbers into a tape 
recorder. The number is then sold and, within a few days, it is in use all 
around the city. People should always be aware of the possibility of shoulder 
surfers in the area." 


Goldstein returned to the 540 subject, pointing out that "because so many 
people don’t realize that it is a billable number, they get caught by ads and 
wind up paying for scam calls. We published a picture in 2600 Magazine of a 
poster seen around New York, advertising apartment rental help by calling a 
540 number. In very tiny print, almost unreadable, it mentions a charge. 
People have to be very careful about things like this." 


Delaney agreed, saying, "The 540 service must say within the first 10 seconds 
that there is a charge, how much it is, and that the person can hang up now 
without being charged -- the guy with the beeper scam didn’t do that and that 
was one of the reasons for his arrest. Many of the services give the charge so 
fast and mix it in with instructions to stay on for a free camera or another 
number to find out about the vacation that they have won that they miss the 
charges and wind up paying. The 540 person has, although he may be trying to 
defraud, complied with the letter of the law and it might be difficult to 
prosecute him. The average citizen must therefore be more aware of these scams 
and protect themselves." 


Goldstein, Phiber Optik, and Delaney spent the remainder of the show answering 
listener questions. Off The Hook is heard every Wednesday evening on New York 
City’s WBAI (99.5 FM). Recent guests have included Mike Godwin, in-house 
counsel of the Electronic Frontier Foundation; and Steve Jackson, CEO of Steve 
Jackson Games. 


Changing Aspects Of Computer Crime Discussed At NYACC May 15, 1992 


By Barbara E. McMullen (Newbytes) 


New York City -- Donald Delaney, New York State Police senior investigator, and 
Mike Godwin, in-house counsel, Electronic Frontier Foundation (EFF), speaking 
to the May meeting of the New York Amateur Computer Club (NYACC), agreed that 
the entrance of organized crime into telecommunications fraud has made the 
subject of computer crime far different than that discussed just a year ago at 
a Similar meeting. 


Newsbytes New York bureau chief John McMullen, moderating the discussion, 
recalled that Delaney in last year’s appearance had called for greater 
education of law enforcement officers in technological areas, the establishment 
of a New York State computer crime lab, outreach by law enforcement agencies to 
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the public to heighten awareness of computer crime and the penalties attached 
—-- items that have all come to pass in the ensuing 12 months. He also 
mentioned that issues involving PBX & cellular phone fraud, privacy concerns 
and ongoing debate over law enforcement wiretapping & decryption capabilities 
have replaced the issues that received most of the attention at last year’s 
meeting. 


Delaney agreed with McMullen, saying that there has been major strides made in 
the education of law enforcement personnel and in the acquisition of important 
tools to fight computer crime. He said that the practice of "carding" -- the 
purchasing of goods, particularly computer equipment, has become a much more 
major problem than it was a year ago and that many more complaints of such 
activities are now received. 


He added that "call-selling" operations, the making of international telephone 
calls to foreign countries for a fee, through the fraudulent use of either a 
company’s private branch exchange (PBX) or an innocent party’s cellular phone 
account, has become so lucrative that arrested suspects have told him that 
"they are moving from drug sales to this type of crime because it is less 
dangerous and more rewarding." 


Delaney pointed out, however, that one of his 1991 arrests had recently been 
murdered, perhaps for trying to operate as an independent in an area that now 
seems to be under the control of a Columbian mob "so maybe it’s not going to 
continue to be less dangerous." 


Delaney also said that PBX fraud will continue to be a problem until the 
companies using PBX systems fully understand the system capabilities and take 
all possible steps to insure security. "Many firms don’t even know that their 
systems have out-dialing capabilities until they get it with additional monthly 
phone charges of upwards of $35,000. They don’t realize that the system has 
default passwords that are supposed to be changed," he said, "It finally hits 
some small businesses when they are bankrupted by the fraudulent long-distance 
charges." 


Godwin, in his remarks, expressed concern that there is not sufficient 
recognition of the uniqueness of BBS and conferencing systems and that, 
therefore, legislators possibly will make decisions based on misunderstandings. 
He said "Telephone conversations, with the exception of crude conference call 
systems are ’one-to-one’ communications. Newspapers and radio & telephone are 
"one-to-many" systems but BBS" are "many-to-many" and this is different. EFF 
is interested in seeing that First Amendment protection is understood as 
applying to BBSs." 


He continued "We also have a concern that law enforcement agencies will respond 
to the challenges of new technology in inappropriate ways. The FBI and Justice 
Department, through the ’Digital Telephony Initiative’ have requested that the 
phone companies such at AT&T and Sprint be required to provide law enforcement 
with the a method of wire-tapping in spite of technological developments that 
make present methods less effectiv 


"Such a procedure would, in effect, make the companies part of the surveillance 
system and we don’t think that that is their job. We think that it is up to 
law enforcement to develop their own crime-fighting tools. When the telephon 
was first developed it made it more difficult to catch crooks. They no longer 
had to stand around together to plan foul deeds; they could do it by telephone. 
Then the government discovered wiretapping and was able to respond. 


"This ingenuity was shown again recently when law enforcement officials, 
realizing that John Gotti knew that his phones were tapped and discussed 
wrongdoings outdoors in front of his house, arranged to have the lampposts 
under which Gotti stood tapped. That, in my judgement, is a reasonable 
approach by law enforcement." 


Godwin also spoke briefly concerning the on-going debate over encryption. "The 
government, through varies agencies such as NSA, keeps attempting to restrict 
citizens from cloaking their computer files or messages in seemingly 
unbreakable coding. We think that people have rights to privacy and, should 
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they wish to protect it by encoding computer messages, have a perfect right to 
do so." 


Bruce Fancher, sysop and owner of the new New York commercial BBS service, 
MindVox, and the last speaker in the program, recounted some of his experiences 
as a "hacker" and asked the audience to understand that these individuals, even 
if found attached to a computer system to which they should not legitimately 
access, are not malicious terrorists but rather explorers. Fancher was a last 
minute replaced for well-known NY hacker Phiber Optik who did not speak, on the 
advice of his attorney, because he is presently the subject of a Justice 
Department investigation. 


During the question and answer period, Delaney suggested that a method of 
resolving the encryption debate would be for third parties, such as banks and 
insurance companies, to maintain the personal encryption key for those using 
encryption. A law enforcement official would then have to obtain a judge’s 
ruling to examine or "tap" the key for future use to decipher the contents of 
the file or messag 


Godwin disagreed, saying that the third party would then become a symbol for 
"crackers" and that he did not think it in the country’s best interests to just 
add another level of complexity to the problem. 


The question and answer period lasted for about 45 minutes with the majority of 
questions concerning encryption and the FBI wiretap proposal. 


Couple Of Bumbling Kids April 24, 1992 


By Alfred Lubrano (Newsday) 


Two young Queens computer hackers, arrested for the electronic equivalent of 
pickpocketing credit cards and going on a computer shopping spree, will be 
facing relatively minor charges. 


Rudolph Loil, age 17, of Woodside, charged with attempted grand larceny, was 
released from police custody on a desk appearance ticket, a spokesman for the 
Queens district attorney’s office said. 


A 15-year-old friend from Elmhurst who was also arrested was referred to Queens 
Family Court, whose proceedings are closed, the spokesman said. He was not 
identified because of his age. 


Law-enforcement sources said they are investigating whether the two were 
"gofers" for adults who may hav ngaged them in computer crime, or whether 
they acted on their own. 


But Secret Service officials, called into the matter, characterized the case as 
"Just a couple of bumbling kids" playing with their computer. 


The youths were caught after allegedly ordering $1,043 in computer equipment 
with a credit card number they had filched electronically from bank records, 
officials said. 


Hackers April 27, 1992 


Taken from InformationWeek (Page 8) 


Two teenagers were arrested last week in New York for using computers to steal 
credit card and telephone account numbers and then charging thousands of 
dollars worth of goods and phone calls to the burgled accounts. 


The two were caught only after som quipment they had ordered was sent to the 
home of the credit card holder whose account number had been pilfered. Their 
arrests closely follow the discovery by the FBI of a nationwide ring of 1,000 
computer criminals, who charge purchases and telephone calls to credit card and 
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phone account numbers stolen from the Equifax credit bureau and other sources. 


The discovery has already led to the arrest of two Ohio hackers and the seizure 
of computer equipment in three cities. 


DOD Gets Fax Evesdroppers April 14, 1992 


By Joseph Albright (Atlanta Journal and Constitution) (Page A12) 


Washington -—- The Air Force is buying a new weapon to battle leaks: A $30,000 
portable fax-tapper. 


Whenever someone transmits a fax, the fax-tapping device attached to the phone 
line will sneak an electronic copy and store it in a laptop computer’s memory. 
Each of the new devices will enable an Air Force intelligence officer to 
monitor four telephones for "communications security" violations. 


Susan Hansen, a Defense Department spokeswoman, said last week that "there is 
no plan right at the moment" to install the devices in the Pentagon, whose 
top leaders have been outraged in recent weeks by leaks of classified policy 
documents to reporters. 


But she left open the possibility that some of them will be attached to 
sensitive military fax lines when the tapping devices are delivered to the Air 
Force six months to a year from now. 


"There are a lot of things that are under review here," she said after 
consulting with the Pentagon’s telecommunications office. 


Plans to buy 40 of the devices were disclosed a few weeks ago in a contract 
notice from a procurement officer at Wright-Patterson Air Force Base near 
Dayton, Ohio. When contacted, a spokesman referred inquiries to the Air 

Force Intelligence Command at Kelly Air Force Base, Texas, which authorized the 
purchase. 


The Air Force Intelligence Command insisted that the devices will never be used 
for law enforcement purposes or even "investigations." 


"The equipment is to be used for monitoring purposes only, to evaluate the 
security of Air Force official telecommunications," said spokesman Dominick 
Cardonita. "The Air Force intelligence command does not investigate." 


Mr. Cardonita said that, for decades, Air Force personnel in sensitive 
installations have been on notice that their voice traffic on official lines is 
subject to "communications security" monitoring. The fax-tapper simply 
"enhances" the Air Force’s ability to prevent "operational security" 
violations, he said. 


He estimated that the Air Force will pay $1.2 million under the contract, due 
to be let this June. That averages out to $ 30,000 for each fax-tapper, but 
Mr. Cardonita said the price includes maintenance and training. 


Douglas Lang, president of Washington’s High Technology Store and an authority 
on security devices, said that, so far as he knows, the Air Force is the first 
government agency to issue an order for fax-tapping machines. 


Mr. Lang said he has heard from industry sources that 15 contractors have 
offered to sell such devices to Wright-Patterson. 


"It is one more invasion of privacy by Big Brother," declared Mr. Lang, who 
predicted that the Air Force will use the devices mainly to catch anyone trying 
to leak commercially valuable information to contractors. 


Judging from the specifications, the Air Force wants a machine that can trace 
leaks wherever they might occur. 


Mr. Cardonita said the Air Force Intelligence Command will use the devices 
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only when invited onto an Air Force base by a top commander. 


900-Number Fraud Case Expected to Set a Trend April 2, 1992 


By David Thompson (Omaha <Nebraska> World-Herald) 


Civil court cases against abuses of 900-toll telephone number "will be slam 
dunks" as the result of the successful prosecution of a criminal case in Omaha 
over 900 numbers, 


a federal postal inspector said. 


Postal inspector Michael Jones said numerous civil actions involving 900 
numbers have been filed, including three recently in Iowa. At least one civil 
case is pending in Nebraska, he said, and there may be others. 


Jones said the mail fraud conviction of Bedford Direct Mail Service Inc. of 
Omaha and its president, Ellis B. Goodman, 52, of 1111 South 113th. Court, may 
have been the first criminal conviction involving 900 numbers. 


The conviction also figures in Nebraska Attorney General Don Stenberg’s 


consumer protection program, which calls attention to abuses of 900 numbers, a 
staff member said. 


Among consumer complaints set to Stenberg’s office, those about 900 numbers 
he top five categories, said Daniel L. Parsons, senior consumer 


rank int 
protectio 


People ar 


n special 


List. 


often 


number, t 


lured by an offer of a gift or prize to dial a toll-free 800 
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hen steered to a series of 900 numbers and charged for each one, 
Parsons said. 


hat during the last two years, state attorneys general have taken 
action against 150 organizations for allegedly abusing 900 numbers. 
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The Charge Of The Carders May 26, 1992 


By Joshua Quittner (<New York> Newsday) (Page 45) 


Computer criminals are after your credit-card numbers -- 
to steal with, sell and swap. 


THE KID, from Springfield Gardens, Queens, was a carder, of course. 


He was doing what carders do: trying to talk a salesman into overnight-— 
expressing him a $4,000 computer system -—- and using a stolen credit-card 
number for payment. 


The salesman was playing right along on the phone; he had also notified a co- 
worker to alert the New York State Police, said William Murphy, a customer 
service manager at Creative Computers, who described th vent as it was 
unfolding on a recent Tuesday morning. Murphy said that on a typical day, as 
many aS a dozen times, carders would call and try to buy everything from modems 
to whole computer systems. 


Murphy said that these days, the security people at Creative Computers are able 
to stop virtually all of them, either by not delivering the goods, or by 
delivering them UPS -- that’s United Police Service. 


He sighed: "It’s amazing that they even try." 


But try they do. And at other places, they’re successful. Where once hacking 
into a credit bureau was a kind of rite of passage for computer intruders, who 
generally did little more than look up credit histories on people like Mik 
Dukakis, now computer criminals are mining national credit bureaus and mail- 
order houses, coming away with credit-card numbers to sell, swap or use for 
mail-order purchases. 


Underground electronic bulletin board systems help spread not only the 
passwords, but the techniques used to tap into different systems. In 

San Diego on April 30, for instance, police raided a bulletin board called 
Scantronics, which offered among other things, step-by-step manuals on how to 
hack into Equifax Credit Information Services and TRW Information Services, the 
largest credit bureaus in the nation, the San Diego Tribune reported. 


"The potential for fraud is enormous, it’s almost limitless," said Joel Lisker, 
Mastercard International’s vice president of security and risk management, who 
noted that computer intruders accessed "thousands" of credit-card account 
numbers in another recent case. 


MASTERCARD is putting together a task force of its bank members to address the 
problem, and is considering inviting hackers in to learn what they can do to 
tighten up computer access to credit bureaus, he said. 


Mastercard estimates it lost $57 million to counterfeit scams last year; Lisker 
said it is impossible to say how much carders contributed. But based on the 
volume of arrests lately, he figures carding has become a big problem. 
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"Tt’s kind of like a farmer that sees a rat," Lisker said. "Tf he sees one, h 
knows he has several. And if he sees several he knows he has a major 
infestation. This is a major infestation." 


"It’s clearly something we should be concerned about," agreed Scott Charney, 
chief of the U.S. Justice Department’s new Computer Crime Unit. Charney said 
that roughly 20 percent of the unit’s current caseload involves credit-card 
fraud, a number that, if nothing else, colors the notion that all hackers are 
misunderstood kids, innocently exploring the world of computer networks. 


"Whether such noble hackers exist, the fact of the matter is we’re seeing 
people out there whose motives are not that pure," he said. 


On May 11, New York State Police arrested thr teenagers in Springfield 
Gardens when one of them went to pick up what he hoped was an Amiga 3000 
computer system from Creative Computers, at a local UPS depot. 


"What he wanted was a computer, monitor and modem. What he got was arrested," 
said John Kearey, a state police investigator who frequently handles computer 
and telecommunications crimes. Police posed as UPS personnel and arrested the 
youth, who led them to his accomplices. 


Kearey said the teens said they got the stolen credit-card number from a 


"hacker who they met on a bridge, they couldn’t remember his name" -- an 
interesting coincidence because the account number was for a next-door neighbor 
of one of the youths. Police suspect that the teens, who claimed to belong to 


a small hacking group called the MOB (for Men of Business) either hacked into a 
credit bureau for the number, got someone else to do it, or went the low-tech 
route —-- "dumpster diving" for used carbon copies of credit receipts. 


Indeed, most credit-card fraud has nothing to do with computer abusers. 
Boiler-room operations, in which fast-talking con men get cardholders to 
divulge their account numbers and expiration dates in exchange for the promise 
of greatly discounted vacations or other too-good-to-be-true deals, are far and 
away the most common scams, said Gregory Holmes, a spokesman for Visa. 


But carders have an advantage over traditional credit-card cheats: By using 
their PCs to invade credit bureaus, they can find credit-card numbers for 
virtually anyone. This is useful to carders who pick specific credit-card 
numbers based on location -- a neighbor is out of town for a week, which means 
all you have to do is get his account number, stake out his porch and sign for 
the package when the mail comes. Another advantage is address and ZIP code 
verifications, once a routine way of double-checking a card’s validity, are no 
longer useful because carders can get that information from an account record. 


"It’s tough," Holmes said. "Where it becomes a major problem is following the 
activity of actually getting the credit-card number; it’s sent out on the black 
market to a vast group of people" generally over bulletin boards. From there, 
a large number of purchases can be racked up in a short period of time, well 
before the cardholder is aware of the situation. While the cardholder is not 
liable, the victims usually are businesses like Creative Computers, or the 
credit-card company. 


Murphy said his company used to get burned, although he would not divulge the 
extent of its losses. "It happened until we got wise enough to their ways," he 
said. 


Now, with arrangements among various law enforcement agencies, telephon 
companies and mail carriers, as well as a combination of call-tracing routines 
and other verification methods, carders "rarely" succeed, he said. Also, a 
dozen employees work on credit-card verification now, he said. "I feel sorry 
for the companies that don’t have the resources to devote departments to filter 
these out. They’re the ones that are getting hit hard." 


In New York, federal, state and local police have been actively investigating 
carder cases. Computers were seized and search warrants served on a number of 
locations in December, as part of an ongoing federal investigation into 

carding. City police arrested two youths in Queens in April after attempting 
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to card a $1,500 computer system from Creative Computers. They were arrested 
when they tried to accept delivery. 


"It’s a legitimate way to make money. I know people who say they do it," 
claimed a 16-year-old Long Island hacker who uses the name JJ Flash. 


While he says he eschews carding in favor of more traditional, non-malicious 
hacking, JJ Flash said using a computer to break into a credit bureau is as 
easy as following a recipe. He gave a keystroke-by-keystroke description of 
how it’s done, a fairly simple routine that involved disguising the carder’s 
calling location by looping through a series of packet networks and a Canadian 
bank’s data network, before accessing the credit bureau computer. Once 
connected to the credit bureau computer, JJ Flash said a password was needed -—- 
no problem, if you know what underground bulletin boards to check. 


"It’s really easy to do. I learned to do it in about thirty seconds. If you 

put enough time and energy into protecting yourself, you’ll never get caught," 
he said. For instance, an expert carder knows how to check his own phone line 
to see if the telephone company is monitoring it, he claimed. By changing the 
location of a delivery at the last minute, he said carders have evaded capture. 


J J FLASH said that while most carders buy computers and equipment for 

themselves, many buy televisions, videocassette recorders and other goods that 
are easy to sell. "You can usually line up a buyer before its done," he said. 
"If you have a $600 TV and you’re selling it for $200, you will find a buyer." 


He said that while TRW has tightened up security during the past year, Equifax 
was still an easy target. 


But John Ford, an Equifax spokesman, said he believes that hackers greatly 
xaggerate their exploits. He said that in the recent San Diego case, only 12 
records were accessed. "It seems to me the notion that anybody who has a PC 
and a modem can sit down and break in to a system is patently untrue," he said. 
"We don’t have any evidence that suggests this is a frequent daily occurrence." 


Regardless, Ford said his company is taking additional steps to minimize the 
risk of intrusion. "If one is successful in breaking into the system, then w 
are instituting some procedures that would render the information that the 
hacker receives virtually useless." 


Also, by frequently altering customers’ passwords, truncating account 
information so that entire credit-card numbers were not displayed, and possibly 
encrypting other information, the system will become more secur 


"We take very seriously our responsibility to be the stewards of consumer 
information," Ford said. 


But others say that the credit bureaus aren’t doing enough. Craig Neidorf, 
publisher of Phrack, an underground electronic publication "geared to computer 
and telecommunications enthusiasts," said that hacking into credit bureaus has 


been going on, and has been easy to do "as long as I’ve been around." Neidorf 
said that although he doesn’t do it, associates tell him that hacking into 
credit bureau’s is "child’s play" -- something the credit bureaus have been 


careless about. 


"For them not to take some basic security steps to my mind makes them 
negligent," Neidorf said. "Sure you can go ahead and have the kids arrested 
and yell at them, but why isn’t Equifax or any of the other credit bureaus not 
stopping the crime from happening in the first place? It’s obvious to me that 
whatever they’re doing probably isn’t enough." 


A Recent History Of Carding 


September 6, 1991: An 18-year-old American emigre, living in Israel, was 
arrested there for entering military, bank and credit bureau computers. Police 
said he distributed credit-card numbers to hackers in Canada and the United 
States who used them to make unknown amounts of cash withdrawals. 
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January 13, 1992: Four university students in San Luis Obispo, California, 
were arrested after charging $250,000 in merchandise to Mastercard and Visa 
accounts. The computer intruders got access to some 1,600 credit-card 
accounts, and used the numbers to buy, among other things: Four pairs of $130 
sneakers; a $3,500 stereo; two gas barbecues and a $3,000 day at Disneyland. 


February 13, 1992: Two teenagers were arrested when one of them went to pick 
up two computer systems in Bellevue, Wash., using stolen credit-card numbers. 
One told police that another associate had hacked into the computer system of a 
mail-order house and circulated a list of 14,000 credit-card numbers through a 
bulletin board. 


April 17, 1992: Acting on a tip from San Diego police, two teenagers in Ohio 
were arrested in connection with an investigation into a nationwide computer 
hacking scheme involving credit-card fraud. Police allege "as many as a 
thousand hackers" have been sharing information for four years on how to use 
their computers to tap into credit bureau databases. Equifax, a credit bureau 
that was penetrated, admits that a dozen records were accessed. 


April 22, 1992: Two Queens teens were arrested for carding computer equipment. 


Invading Your Privacy May 24, 1992 


By Rob Johnson (The Atlanta Journal and Constitution) (Page AQ) 


Some do it for fun, others have more criminal intent. Regardless, computer 
users have a range of techniques and weaponry when breaking into files. 
"Rooting" forbidden files is hog heaven for hackers 


Within an instant, he was in. 
Voodoo Child, a 20-year-old college student with a stylish haircut and a well- 


worn computer, had been cruising a massive researchers’ network called Internet 
when he stumbled upon a member account he hadn’t explored for a while. 


The institution performed "Star Wars" research, he later found out, but that 
didn’t interest him. "I don’t know or care anything about physics," he said 
recently. "I just wanted to get root." 


And "getting root," hackers say, means accessing the very soul of a computer 
system. 


Working through the network, he started a program within the research 


institute’s computers, hoping to interrupt it at the right moment. "I figured 
I just had a second," he said, gesturing with fingers arched above an imaginary 
keyboard. Suddenly he pounced on the phantom keys. "And it worked." 


He soon convinced the computer he was a system operator, and he built himself a 
back door to Internet: He had private access to exotic supercomputers and 
operating systems around the world. 


Before long, though, the Atlanta-area hacker was caught, foiled by an MCI 
investigator following his exploits over the long-distance phone lines. 
National security experts sweated over a possible breach of top-secret 
research; the investigation is continuing. 


And Voodoo Child lost his computer to law enforcement. 


"I was spending so much time on the computer, I failed out of college," he 
said. "I would hack all night in my room, go to bed and get up at 4 in the 
afternoon and start all over." 


In college, he and a friend were once discovered by campus police dumpster- 
diving behind the university computer building, searching for any scraps of 
paper that might divulge an account number or a password that might help them 
crack a computer. 
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Now he’s sweating it out while waiting for federal agents to review his case. 
"I’m cooperating fully," he said. "I don’t want to go to prison. I’11 do 
whatever they want me to." 


In the meantime, he’s back in college and has taken up some art projects he’d 
abandoned for the thrill of computer hacking. 


The free-form days of computer hacking have definitely soured a bit -- even for 
those who haven’t been caught by the law. 


"It’s a lot more vicious," Voodoo Child said as a friend nodded in agreement. 
"Card kids" -- young hackers who ferret out strangers’ credit card numbers and 
calling card accounts -- are wrecking the loose communal ethic that defined 
hacking’s earlier, friendlier days. 


And other computer network users, he said, are terrified of the tactics of 
sophisticated hackers who routinely attack other computer users’ intelligence, 


reputation and data. 


"IT used to run a BBS [electronic bulletin board system] for people who wanted 


to learn about hacking," Voodoo Child said. "But I never posted anything 
illegal. It was just for people who had questions, who wanted to do it 
properly." 


Doing it properly, several Atlanta-area hackers say, means exploring the gaps 
in computer networks and corporate systems. They say it’s an intellectual 
exercise -—- and an outright thrill -- to sneak into someone else’s computer. 


During a recent interview, Voodoo Child and a friend with a valid Internet 
account dialed up the giant network, where some of their counterparts were 


waiting for a reporter to ask them some questions. 


"Did you get that information on the Atlanta Constitution reporter you were 
asking about?" a faceless stranger asked. 


A startled reporter saw his credit report and credit card numbers flashed 


across the screen. Voodoo Child offered up the keyboard -- an introduction of 
sorts to a mysterious, intimidating accomplice from deep inside the digital 
otherworld. "Go ahead," he said. "Ask him anything you want." 

KV4FZ: Guilty Of Telephone Toll Fraud May 15, 1992 


By John Rice (rice@ttd.teradyne.com) in TELECOM Digest V12 #412 


St. Croix ham operator, Herbert L. "Herb" Schoenbohm, KV4FZ, has been found 
guilty in federal court of knowingly defrauding a Virgin Islands long-distance 
telephone service reseller. He was convicted April 24th of possessing and 
using up to fifteen unauthorized telephone access devices in interstate and 
foreign commerce nearly five years ago. 


The stolen long distance telephone access codes belonged to the Caribbean 
Automated Long Lines Service, Inc. (CALLS) of St. Thomas, U.S. Virgin Islands. 
Schoenbohm was found to have made more than $1,000 in unauthorized telephone 
calls -- although the prosecution said he was responsible for far more. 


According to the Virgin Islands Daily News, Schoenbohm, who is also the St. 
Croix Police Chief of Communications, showed no emotion when he was pronounced 
guilty of the charges by a 12 member jury in U.S District Court in 
Christiansted. The case was heard by visiting District Judge Anne Thompson. 


Neither Schoenbohm or his defense attorney, Julio Brady, would comment on the 
verdict. The jury deliberated about seven hours. The sentencing, which has 
been set for June 26, 1992, will be handled by another visiting judge not 
familiar with the case. 


Schoenbohm, who is Vice Chairman of the V.I. Republican Committee, has been 
released pending sentencing although his bail was increased from $5,000 to 
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$25,000. While he could receive a maximum of ten years on each count, 

Assistant U.S. Attorney Alphonse Andrews said Schoenbohm probably will spend no 
more than eight months in prison since all three counts are similar and will be 
merged. 


Much of the evidence on the four day trial involved people who received 
unauthorized telephone calls from KV4FZ during a 1987 period recorded by the 
CALLS computer. Since the incident took place more than five years ago, many 
could not pinpoint the exact date of the telephone calls. 


The prosecution produced 20 witnesses from various U.S locations, including 
agents from the Secret Service, the U.S. Marshals Service, Treasury Department 
and Federal Communications Commission. In addition ham operators testified for 
the prosecution. 


Schoenbohm was portrayed as a criminal who had defrauded calls out of hundreds 
of thousands of dollars. Schoenbohm admitted using the service as a paying 
customer, said it did not work and that he terminated the service and never 
used it again. He feels that there was much political pressure to get him 
tried and convicted since he had been writing unfavorably articles about 
Representative DeLugo, a non-voting delegate to Congress from the Virgin 
Islands, including his writing of 106 bad checks during the recent rubbergate 
scandal. 


Most, but not all the ham operators in attendance were totally opposed to 


KV4FZ. Bob Sherrin, W4ASX from Miami attended the trial as a defense character 
witness. Sherrin told us that he felt the conviction would be overturned on 
appeal and that Schoenbohm got a raw deal. "They actually only proved that he 


made $50 in unauthorized calls but the jury was made to believe it was $1,000." 


Schoenbohm’s attorney asked for a continuance due to newly discovered evidence, 
but that was denied. There also is a question as to whether the jury could 
even understand the technology involved. "Even his own lawyer couldn’t 
understand it, and prepared an inept case," Sherrin said. "I think he was 
railroaded. They were out to get him. There were a lot of ham net members 
there and they were all anti-Herb Schoenbohm. The only people that appeared 
normal and neutral were the FCC. The trial probably cost them a million 
dollars. All his enemies joined to bring home this verdict." 


Schoenbohm had been suspended with pay from the police department job since 
being indicted by the St. Croix grand jury. His status will be changed to 
suspension without pay if there is an appeal. Termination will be automatic if 
the conviction is upheld. Schoenbohm’s wife was recently laid off from her job 
at Pan Am when the airline closed down. Financially, it could be very 
difficult for KV4FZ to organize an appeal with no money coming in. 


The day after the KV4F2Z conviction, Schoenbohm who is the Republican Committee 
vice chairman was strangely named at a territorial convention as one of eight 


delegates to attend the GOP national convention in Houston this August. He was 
nominated at the caucus even though his felony conviction was known to 
everyone. Schoenbohm had even withdrawn his name from consideration since he 


was now a convicted felon. 


The Virgin Island Daily News later reported that Schoenbohm will not be 
attending the GOP national convention. "Schoenbohm said he came to the 
conclusion that my remaining energies must be spent in putting my life back 
together and doing what I can to restore my reputation. I also felt that any 
publicity in association with my selection may be used by critics against the 
positive efforts of the Virgin Islands delegation." 


Schoenbohm has been very controversial and vocal on the ham bands. Some ham 
operators now want his amateur radio license pulled and have made certain 
that the Commission is very much aware of his conviction. 


AT&T Launches Program To Combat Long-Distance Theft May 13, 1992 


By Virginia Randall (United Press International/UPI) 
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Citing the mushrooming cost of long-distance telephone fraud, American 
Telephone & Telegraph Co. announced plans to combat theft of long-distance 
telephone services from customers. 


AT&T’s program, dubbed NetProtect, is an array of software, consulting, 
customer education and monitoring services for businesses. One program limits 
customer liability to the first $25,000 of theft, while another ends customer 
liability entirely under certain circumstances. 


By law, companies are liable for the cost of calls made on their systems, 
authorized or not. 


Jerre Stead, president of AT&T’s Business Communications unit, said, "The 
program not only offers financial relief to victims of long-distance fraud. 

It also gives our customers new products and services specifically designed to 
prevent and detect fraud." 


Long-distance calling fraud ranges from a few dollars to the hundreds of 
thousands of dollars for victims. The Communications Fraud Control 
Association, an industry group, estimates long-distance calling fraud costs 
more than $1 billion a year, said Peggy Snyder, an association spokeswoman. 


NetProtect Basic Service, offered fr with long-distance and domestic 800 
service, consists of ongoing monitoring around the clock for unusual activity. 


The company will start this service this week. 


NetProtect Enhanced and Premium services offer more customized monitoring and 
limit customer liability to $25,000 per incident or none at all, depending on 
the program selected. 


Pricing and permission to provide the Enhanced and Premium services are 
dependent on Federal Communication Commission approval. AT&T expects to offer 
these programs beginning August 1. 


Other offerings are a $1,995 computer software package called "Hacker Tracker," 
consulting services and the AT&T Fraud Intervention Service, a swat team of 
specialists who will detect and stop fraud while it is in progress. 


The company also will provide a Security Audit Service that will consult with 
customers on possible security risks. Pricing will be calculated on a case-by- 
case basis, depending on complexity. 


The least expensive option for customers is AT&T’s Security Handbook and 
Training, a self-paced publication available for $65 which trains users on 
security features for AT&T’s PBX, or private branch exchanges, and voice mail 
systems. 


Fraud occurs through PBX systems, which are used to direct the external 
telephone calls of a business. 


Company employees use access codes and passwords to gain entry to their PBX 
system. A typical use, the industry fraud group’s Snyder said, would be a 

sales force on the road calling into their home offices for an open line to 
call other customers nationally or worldwide. 


These access codes can be stolen and used to send international calls through 
the company’s network, billable to the company. 


Unauthorized access to PBXs occur when thieves use an automatic dialing feature 
in home computers to dial hundreds of combinations of phone numbers until they 
gain access to a company’s PBX system. 


These thieves, also known as hackers, phone freaks or phrackers, then make 
their own calls through the PBX system or sell the number to a third party to 
make calls. 
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Others use automatic dialing to break into PBX systems through voice mail 
systems because such systems have remote access features. 


Calls from cellular phones also are at risk if they are remotely accessed to a 
PBX. Electronic mail systems for intracompany calls are not affected becaus 
they don’t require PBX systems. 


According to Bob Neresian of AT&T, most fraud involves long-distance calls to 
certain South American and Asian countries, especially Columbia and Pakistan. 


There is no profile of a typical company at risk for telephone fraud, said 
Snyder. 


"Any company of any size with long-distance service is at risk," she said. 
"Criminals don’t care who the long distance provider is or how big the company 
they’ re stealing from is." 


She said the industry recognized the dimensions of telephone theft in 1985, 
when the Communications Fraud Control Association was formed in Washington D.C. 
The group consists of providers of long-distance service, operator services, 
private payphones, end-users of PBX systems, federal, state and local law 
nforcement agencies and prosecutors. 


Janice Langley, a spokeswoman for US Sprint Corp. in Kansas City, Mo., called AT&T’s announ 
cement similar to a program her company announced March 31. 


That service, SprintGuard Plus, is available to companies with a call volume 
of $30,000 a month. Sprint also offers basic monitoring program to customers 
without charge. 


"We don’t have minimum billing requirements for any of these services or 
systems," responded AT&T’s Neresian. "All the carriers have seen the problem 
and have been working on their own approaches," he said. 


Jim Collins, a spokesman for MCI Communications in Washington, said his company 
had been conducting phone fraud workshops free of charge for customers for four 
years. 
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New Phones Stymie FBI Wiretaps April 29, 1992 


By Simson L. Garfinkel (Christian Science Monitor) (Page 12) 


"Legislation proposed by Justice Department would change the way 
telecommunications equipment is developed in the United States." 


For more than 50 years, wiretapping a telephone has been no more difficult than 
attaching two clips to a telephone line. Although legal wiretaps in the United 
States have always required the approval of a judge or magistrate, the actual 
wiretap has never been a technical problem. Now that is changing, thanks to 
the same revolution in communications that has made car phones, picture 
telephones, and fax machines possible. 


The only thing a person tapping a digital telephone would hear is the 


indecipherable hiss and pop of digital bits streaming past. Cellular 
telephones and fiber-optic communications systems present a would-be wiretapper 
with an even more difficult task: There isn’t any wire to tap. 


Although cellular radio calls can be readily listened in on with hand-held 
scanners, it is nearly impossible to pick up a particular conversation -- or 
monitor a particular telephone -- without direct access to the cellular 
telephone "switch," which is responsible for connecting the radio telephones 
with the conventional telephone network. 


This spring, the Federal Bureau of Investigation (FBI) unveiled legislation 

that would require telephone companies to include provisions in their equipment 
for conducting court-ordered wiretaps. But critics of the legislation, 
i 
F 
i 


ncluding some members of Congress, claim that the proposals would expand the 
BI’s wiretap authority and place an undue burden on the telecommunications 
ndustry. 


Both sides agree that if provisions for monitoring communications are not made 
in the planning stages of new equipment, it may eventually become impossible 
for law enforcement personnel to conduct wiretaps. 


"If the technology is not fixed in the future, I could bring an order [for a 
wiretap] to the telephone company, and because the technology wasn’t designed 
with our requirement in mind, that person could not [comply with the court 
order]," says James K. Kalstrom, the FBI’s chief of engineering. 


The proposed legislation would require the Federal Communications Commission 
(FCC) to establish standards and features for makers of all electronic 
communications systems to put into their equipment, require modification of all 
existing equipment within 180 days, and prohibit the sale or use of any 
equipment in the US that did not comply. The fine for violating the law would 
be $10,000 per day. 


"The FBI proposal is unprecedented," says Representative Don Edwards (D) of 
California, chairman of the House Judiciary Subcommittee on Civil and 
Constitutional Rights and an outspoken critic of the proposal. "It would give 
the government a role in the design and manufacture of all telecommunications 
equipment and services." 
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Equally unprecedented, says Congressman Edwards, is the legislation’s breadth: 
The law would cover every form of electronic communications, including cellular 


telephones, fiber optics, satellite, microwave, and wires. It would cover 
electronic mail systems, fax machines, and all networked computer systems. It 
would also cover all private telephon xchanges -- including virtually every 
office telephone system in the country. 


Many civil liberties advocates worry that if the ability to wiretap is 
specifically built into every phone system, there will be instances of its 
abuse by unauthorized parties. 


Early this year, FBI director William Sessions and Attorney General William 
Barr met with Senator Ernest F. Hollings (D) of South Carolina, chairman of the 
Senate Commerce Committee, and stressed the importance of the proposal for law 
enforcement. 


Modifying the nation’s communications systems won’t come cheaply. Although 
the cost of modifying existing phone systems could be as much as $300 million, 
"We need to think of the costs if we fail to enact this legislation," said Mr. 
Sessions before a meeting of the Commerce, Justice, State, and Judiciary 
Subcommittees in April. The legislation would pass the $300 million price-tag 
along to telephone subscribers, at an estimated cost of 20 cents per lin 


But an ad-hoc industry coalition of electronic communications and computer 
companies has objected not only to the cost, but also to the substance of the 
FBI’s proposal. In addition, they say that FCC licensing of new technology 
would impede its development and hinder competitiveness abroad. 


Earlier this month, a group of 25 trade associations and major companies, 
including AT&T, GTE, and IBM, sent a letter to Senator Hollings saying that "no 
legislative solution is necessary." Instead, the companies expressed their 
willingness to cooperate with the FBI’s needs. 


FBI officials insist that legislation is necessary. "If we just depend on 
jaw-boning and waving the flag, there will be pockets, areas, certain places" 
where technology prevents law enforcement from making a tap, says Mr. Kalstrom, 
the FBI engineer. "Unless it is mandatory, people will not cooperate." 


For example, Kalstrom says, today’s cellular telephone systems were not built 
with the needs of law enforcement in mind. "Some companies have modified their 
equipment and we can conduct surveillance," he says. But half of the companies 
in the US haven’t, he adds. 


Jo-Anne Basile, director of federal relations for the Cellular 
Telecommunications Industry Association here in Washington, D.C., disagrees. 


"There have been problems in some of the big cities because of [limited] 
capacity," Ms. Basile says. For example, in some cities, cellular operators 
had to comply with requests for wiretaps by using limited "ports" designed for 
equipment servicing. Equipment now being installed, though, has greatly 
xpanded wiretap capacity in those areas. 


"We believe that legislation is not necessary because we have cooperated in 
the past, and we intend on cooperating in the future," she adds. 


The real danger of the FBI’s proposal is that the wiretap provisions built in 
for use by the FBI could be subverted and used by domestic criminals or 
commercial spies from foreign countries, says Jerry Berman, director of the 
Electronic Frontier Foundation, a computer users’ protection group in 
Cambridge, Mass. 


"Anytime there is a hearing on computer hackers, computer security, or 
intrusion into AT&T, there is a discussion that these companies are not doing 
enough for security. Now here is a whole proposal saying, ’Let’s make our 
computers more vulnerable.’ If you make it more vulnerable for the Bureau, 
don’t you make it more vulnerable for the computer thief?" 
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Civil liberties advocates also worry that making wiretaps easier will have the 
effect of encouraging their us something that the FBI vehemently denies. 


"Doing a wiretap has nothing to do with the [technical] ease," says Kalstrom. 
"It is a long legal process that we must meet trying all other investigations 
before we can petition the court." 


Kalstrom points out the relativ ase of doing a wiretap with today’s telephone 
system, then cites the federal "Wiretap Report," which states that there were 
only 872 court-approved wiretaps nationwide in 1990. "Ease is not the issue. 
There is a great dedication of manpower and cost," he says. But digital 
wiretapping has the potential for drastically lowering the personnel 
requirements and costs associated with this form of electronic surveillance. 
Computers could listen to the phone calls, sitting a 24-hour vigil at a low 
cost compared with the salary of a flesh-and-blood investigator. 


"Now we are seeing the development of mor ffective voice-recognition 
systems," says Edwards. "Put voice recognition together with remote-access 
monitoring, and the implications are bracing, to say the least." 


Indeed, it seems that the only thing both sides agree on is that digital 
telephone systems will mean more secure communications for everybody. 


"It is extremely easy today to do a wiretap: Anybody with a little bit of 
knowledge can climb a telephone poll today and wiretap someone’s lines," says 
Kalstrom. "When the digital network goes end-to-end digital, that will 
preclude amateur night. It’s a much safer network from the privacy point of 
view." 


FBI Fight With Computer, Phone Firms Intensifies May 4, 1992 


Taken from Los Angeles Times (Business, Part D, Page 2) 


"Spy Agencies Oppose Technology That Will Prevent 
Them From Tapping Into Data And Conversations" 


Top computer and telecommunications executives are fighting attempts by the FBI 
and the nation’s intelligence community to ensure that government surveillance 
agencies can continue to tap into personal and business communications lines as 
new technology is introduced. 


The debate flared last week at a House Judiciary Committee hearing on foreign 
intelligence agencies’ attempts to gather U.S. companies’ secrets. The 
committee’s chairman, Representative Jack Brooks (D-Tex.), called the hearing 
to complain that the FBI and the National Security Agency (NSA) are hurting 
companies’ attempts to protect their communications. 


The issue has been heating up on two fronts. Phone companies have been 
installing digital equipment that frustrates phone tapping efforts, and 
computer companies are introducing new methods of securing data transmissions 
that are almost impossible for intelligence agencies to penetrate. 


The controversy centers, in part, on an FBI attempt to persuade Congress to 
force telephone companies to alter their digital networks, at a possible cost 
of billions of dollars that could be passed on to ratepayers, so that the FBI 
can continue performing court-authorized wiretaps. Digital technology 
temporarily converts conversations into computerized code, which is sent at 
high speed over transmission lines and turned back to voice at the other end, 
for efficient transmission. 


Civil liberties groups and telecommunications companies are fiercely resisting 
the FBI proposal, saying it will stall installation of crucial technology and 
negate a major benefit of digital technology: Greater phone security. The 
critics say the FBI plan would make it easier for criminals, terrorists, 
foreign spies and computer hackers to penetrate the phone network. The FBI 
denies these and other industry assertions. 
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Meanwhile, the NSA, the nation’s super-secret eavesdropping agency, is trying 
to ensure that government computers use a computer security technology that 
many congressmen and corporat xecutives believe is second-rate, so that NSA 
can continue monitoring overseas computer data transmissions. Corporations 
likely would adopt the government standard. 


Many corporate executives and congressmen believe that a branch of the Commerce 
Department that works closely with NSA, the National Institute of Standards and 
Technology (NIST), soon will endorse as the government standard a computer- 
security technology that two New Jersey scientists said they penetrated to 
demonstrate its weakness. NIST officials said that their technology wasn’t 
compromised and that it is virtually unbreakable. 


"In industry’s quest to provide security (for phones and computers), we have a 
new adversary, the Justice Department," said D. James Bidzos, president of 
California-based RSA Data Security Inc., which has developed a computer- 
security technology favored by many firms over NIST’s. "It’s like saying that 
we shouldn’t build cars because criminals will use them to get away." 


"What’s good for the American company may be bad for the FBI" and NSA, said 
Representative Hamilton Fish Jr. (R-N.Y.). "It is a very heavy issue here." 


The situation is a far cry from the 1950s and 1960s, when companies like 
International Business Machines Corporation and AT&T worked closely with law- 
enforcement and intelligence agencies on sensitive projects out of a sense of 
patriotism. The emergence of a post-Vietnam generation of executives, 
especially in new high-technology firms with roots in the counterculture, has 
short-circuited the once-cozy connection, industry and government officials 
said. 


"I don’t look at (the FBI proposal) as impeding technology," FBI Director 
William S. Sessions testified at the Judiciary Committee hearing. "There is a 
burden on the private sector . . .a price of doing business." 


FBI officials said they have not yet fumbled a criminal probe due to inability 


to tap a phone, but they fear that time is close. "It’s absolutely essential 
we not be hampered," Sessions said. "We cannot carry out our responsibilities" 
if phone lines are made too secure. 


On the related computer-security issue, the tight-lipped NSA has never 
commented on assertions that it opposes computerized data encryption 
technologies like that of RSA Data Security because such systems are 
uncrackable. 


For more articles on this same topic, please see: 


Phrack 38, File 11; The Digital Telephony Proposal. 


FBI Seeks Compiled Lists For Use In Its Field Investigation April 20, 1992 
By Ray Schultz (DMNews) (Page 1) 
Special Thanks: The Omega and White Knight 


Washington, D.C. -—- The Federal Bureau of Investigation, in a move that could 
spell trouble for the industry, reported is seeking commercial mailing lists 
for use in its investigations. 


Spokespersons for both MetroMail Corporation and Donnelley Marketing confirmed 
that they were approached for services within the last two weeks and other 
firms also received feelers. 


Neither of the identified firms would discuss details, but one source familiar 
with the effort said the FBI apparently is seeking access to a compiled 
consumer database for investigatory uses. 
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The FBI agents showed "detailed awareness" of the products they were seeking, 
and claimed to have already worked with several mailing list companies, 
according to the source. 


Metromail, which has been supplying the FBI with its MetroNet address lookup 
service for two years, did not confirm this version of events. Spokesperson 
John Tomkiw said only that the firm was asked by the FBI about a "broadening" 
of its services. 


The firm has supplied the bureau with a full listing of its products and 
services, but has not yet been contacted back and is not sure what action it 
will take, said Tomkiw. 


Donnelley was also vague on the specifics of the approach, but did say it has 
declined any FBI business on the grounds that it would be an inappropriate use 
of its lists. 


FBI spokesperson Bill Carter was unable to provide confirmation, although he 
did verify that the FBI uses MetroNet to locate individuals needed for 
interviews. 


If the database scenario is true, it would mark the first major effort by a 
government agency to use mailing lists for enforcement since the Internal 
Revenue Service tried to use rented lists to catch tax cheats in 1984. 


"We have heard of it," said Robert Sherman, counsel to the Direct Marketing 
Association and attorney with the firm of Milgrim Thomajan & Lee, New York. 
"We’d like to know more about it. If it is what it appears to be, law 
nforcement agents attempting to use marketing lists for law enforcement 
purposes, then the DMA and industry would certainly be opposed to that on 
general principles." 


Such usage would "undermine consumer confidence in th ntire marketing process 
and would intrude on what otherwise would be harmless collection of data," 
Sherman said. 


RL Polk, which has not been contacted, said it would decline for the same 
reasons if approached. 


"That’s not a proper use of our lists," said Polk chairman John O’Hara. "We’re 
in the direct mail business and it’s our policy not to let our lists be used 
for anything but marketing purposes." 


According to one source, who requested anonymity, the FBI intimated that it 
would use its subpoena power if refused access to the lists. 

The approaches, made through the FBI training center in Quantico, VA, 
reportedly were not the first. 


7 
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he FBI’s Carter said the MetroNet product was used for address lookups only. 


"If a field office needs to locate somebody for an interview, we can check the 
MetroNet] database as to where they reside and provide that information to the 
field office," he said. 


However, the product was cited as a potential threat to privacy last year by 
Richard Kessel, New York State Consumer Affairs Commissioner. 


In a statement on automatic number identifiers, Kessel’s office said that "one 
firm offers to provide 800-number subscribers immediate access to information 
on 117-million customers in 83-million households nationwide. 


"The firm advertises that by matching the number of an incoming call into its 
database, and an 800 subscriber within seconds can find out such information as 
whether the caller has previously purchased items from their companies." 


Kessel included a copy of a trade ad for MetroNet, in which the product is 
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presented as a direct marketing tool. 


Under the headline "Who am I?" the copy reads as if it is by an imaginary 
consumer. 


"The first step to knowing me better is as easy as retrieving my phone number 


in an Automatic Number Identification environment," it says. "Within seconds 
you can search your internal database to see if I’ve purchased from you before. 
And if it’s not to be found, there’s only one place to go to MetroNet. 


"MetroNet gives you immediate access to information on 117-million consumers in 
83-million households nationwide: recent addresses; phone numbers; specific 
demographics and household information." 


Tomkiw defended the product, saying its primary focus is "direct marketing. 
We’re always sensitive to those types of issues." 


MetroNet works as an electronic white pages, but does not contain "a lot of 
demograhpic data," he said. "It’s primarily used by the real estate and 
insurance industries." 


The 1984 IRS effort reportedly was a failure, but it created a public outcry 
and much negative publicity for the industry. Though Polk, MetroMail and 
Donnelley all refused to rent their lists for the effort, the IRS was able to 
locate other lists through Dunhill of Washington. Most industry sources say 
that such efforts are doomed to fail because lists are useful only in 
identifying people in aggregate, not as individuals." 


Do You Know Where Your Laptop Is? May 11, 1992 


By Robert Kelly (InformationWeek) 


Are your executives carrying computers with critical data? 
If so, company secrets are vulnerabl 


It was an expensive round of window shopping. On December 17, 1990, David 
Farquhar parked his car in downtown London to browse through an automobile 
showroom. A Wing Commander in Great Britain’s Royal Air Force, he was enjoying 
a few moments away from the mounting pressures leading up to the Gulf War, 
which would begin less than a month later. 


But Farquhar made a huge mistake: He left his laptop computer in his car. And 
although he was gone a mere five minutes, by the time he returned, the laptop 
had been stolen -- as had U.S. General Norman Schwarzkopf’s plans, stored in 
the computer’s disk drive, for the upcoming Allied strike against Iraq. 


Farquhar paid dearly for his carelessness. Soon after the red-faced Wing 
Commander reported the incident, he was court-martialed, demoted, and slapped 
with a substantial fine. The computer was anonymously returned a week later 
with the disk drive intact. 


Farquhar may feel alone in his dilemma and rue the wrong turn his life has 
taken, but such episodes are anything but isolated. Though electronic security 
sources say it’s too soon to keep score yet on the exact number of laptop 
thefts, anecdotally, at least, it appears a computer crime wave is underway. 
According to electronic data experts, during the past 18 months, as laptop 
purchases have soared, theft has taken off also. 


For instance, at the Computer Security Institute (CSI), an organization that 
ironically comprises corporate security experts, a half-dozen members have 
already reported their company laptops stolen, says Phil Chapnick, director of 
the San Francisco-based group. And there are probably more that aren’t 
speaking about it, he adds: "Victims prefer to maintain a low profile." 


So do the perpetrators, obviously. But a picture of who some of them are is 
beginning to emerge, says John Schey, a security consultant for the federal 
government. He says a roving band of "computer hit men" from New York, Los 
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Angeles, and San Francisco has been uncovered; members are being paid upwards 
of $10,000 to steal portable computers and strategic data stored on those 


machines from executives at Fortune 1,000 companies. Federal agents, Schey 
adds, are conducting a "very, very dynamic and highly energized investigation 
to apprehend the group." U.S. law enforcement authorities refuse to comment on 


the issue. 


Laptop theft is not, of course, limited to the United States. According to 
news reports, and independently confirmed by InformationWeek, visiting 
executives from NCR Corp. learned that reality the hard way recently when they 
returned to their rooms after dinner at the Nikko Hotel in Paris to find the 
doors removed from their hinges. The rooms were ransacked, turned upside down, 
but the thieves found what they were looking for. All that was taken were two 
laptops containing valuable corporate secrets. 


Paul Joyal, president of Silver Spring, Maryland, security firm Integer anda 
former director of security for the Senate Intelligence Committee, says he 
learned from insiders close to the incident that French intelligence agents, 
who are known for being chummy with domestic corporations, stole the machines. 
Joyal suspects they were working for a local high-tech company. An NCR 
spokesman denies knowledge of the incident, but adds that "with 50,000 
employees, it would be impossible to confirm." Similar thefts, sources say, 
have occurred in Japan, Iraq, and Libya. 


It’s not hard to figure out why laptop theft is on the rise. Unit sales of 
laptops are growing 40% annually, according to market researchers Dataquest 
Inc., and more than 1 million of them enter the technology stream each year. 
Most of the machines are used by major companies for critical tasks, such as 
keeping the top brass in touch when they’re on the road, spicing up sales calls 
with real data pulled from the corporate mainframe, and entering field data 
into central computers. Because of laptops, says Dan Speers, an independent 
data analyst in West Paterson, New Jersey, "there’s a lot of competitive data 
floating around." 


And a perfect way to steal information from central corporate databases. 
Thieves are not only taking laptops to get at the data stored in the disk 
drives, but also to dial into company mainframes. And sometimes these thieves 
are people the victims would least suspect. One security expert tells of "the 
wife of a salesman for a Fortune 500 manufacturing firm who worked for a direct 
competitor." While her husband slept, she used his laptop to log on to a 
mainframe at his company and download confidential sales data and profiles of 
current and potential customers. "The husband’s job," says the security 
expert, "not the wife’s, was terminated." 


Such stories, and there are plenty of them, have led many U.S. companies to 
give lip service to laptop theft, but in almost all cases they’re not doing 
much about it. "Management has little or no conception of the vulnerability of 
their systems," says Winn Schwartau, executive director of InterPact, an 
information security company in Nashville. That’s not surprising, adds CSI’s 
Chapnick: "Security typically lags technology by a couple of years." 


Playing Catch-Up 


Still, some companies are trying to catch up quickly. Boeing Corp., Grumman 
Corp., and Martin Marietta Corp., among others, have adopted strict policies on 
portable data security. This includes training staffers on laptop safety 
rules, and even debriefing them when they return from a trip. One company, 
sources say, was able to use such a skull session to identify a European hotel 
as a threat to data security, and put it on the restricted list for future 
trips. 


Conde Nast Publications Inc. is taking the the issu ven more seriously. The 
New York-based magazine group’s 65-member sales force uses laptops to first 
canvas wholesalers, then upload data on newsstand sales and distribution 
problems to the central mainframe. To ensure that the corporate database isn’t 
poisoned by rogue data, "we have a very tight security system," says Chester 
Faye, Conde Nast’s director of data processing. That system’s centerpiece is a 
program, created in-house at Conde Nast, that lets the mainframe read an 
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identification code off of the chip of each laptop trying to communicate with 
it. "The mainframe, then, can hang up on laptops with chip IDs it doesn’t 
recognize and on those reported stolen by sales reps," says Faye. 


And some organizations hope to go to even greater lengths. InterPact’s 
Schwartau says a government agency in Great Britain wants to build a device 
that attaches to a user’s belt and disconnects communication to a mainframe 
when the laptop deviates 15 degrees vertically. The reason: To protect 
corporate data if the person using the laptop is shot and killed while dialing 
in. 


Users say they’re taking such extreme measures because the vendors don’t; most 
laptops arrive from the factory without adequate security protection. Most 
require a password before booting, but thieves can decipher them with relative 
ease. Some also have removable hard drives, but again, these can be stolen 
with similar impunity and therefore provide little protection. 


Ironically, none of this may be necessary; experts emphasize that adding 
security to a laptop will not serve to price it out of existence. By some 
estimates, building in protection measures raises the price of a laptop by at 
most 20%. Beaver Computer Corp. in San Jose, California, for example, has a 
product to encrypt the data on a laptop’s hard drive and floppy disks. With 
this, the information can’t be accessed without an "electronic key" or 
password. BCC has installed this capability on its own laptop, the SLOO7, 
which seems to have passed muster with some very discriminating customers: 
S 
t 


ources close to the company say a major drug cartel in Colombia wants some of 
hese machines to protect drug trafficking data. 


Equally important is the need to protect data in the host computer from hackers 
who have stolen passwords and logons. Security Dynamics Technologies Inc. in 
Cambridge, Massachusetts, offers the credit card-sized SecurID, which can be 
attached to most laptops. SecurID consists of a $60 device that is connected 
to the laptop, and additional hardware (Cost: $3,800 to $13,000) installed on 
the host. SecurID continuously changes the logon used to dial into the host; 
by the time a hacker gets around to using a stolen logon, for instance, it will 
be obsolete. 


But what if all measures fail? You can always insure the hardware; can you 
insure the data? Not yet, but soon, says Nashville-based newsletter Security 
Insider Report. An upstart startup will soon begin offering data insurance 
policies that may include coverage of information lost when a portable computer 
is stolen. 


Company Cooperation 


>From protection to insurance, however, no measure can work unless laptop owners 
take the problem seriously. And that doesn’t always happen. Case in point: In 
the late 1980s, the Internal Revenue Service approached Schwartau’s firm to 
develop a blueprint for securing the confidential data that travels over phone 
lines between the 30,000 laptops used by field auditors and IRS offices. 
Schwartau came up with a solution. But the IRS shelved its security plans, and 
has done nothing about it since, he charges. 


Even those who should know better can run afoul of the laptop crime wave. 

About 18 months ago, Ben Rosen, chairman of laptop maker Compaq Computer Corp., 
left his machine behind on the train; it was promptly stolen. Rosen insists 
there was no sensitive data in the computer, but he did lose whatever he had. 
Unlike Schwarzkopf’s plans, the laptop was never returned. 
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Airline Claims Flier Broke Law To Cut Costs April 21, 1992 


By Del Jones (USA Today) (Page 1B) 


CHICAGO -- American Airlines had one of its most frequent business fliers 
arrested and handcuffed last summer as he prepared to board a flight at Dallas-— 
Fort Worth Airport. 


The nation’s largest airline -- and the industry’s trend setter says it 
uncovered, then snuffed, a brilliant ticket fraud scheme that cost American 
more than $200,000 over 20 months. Economist William Gibson, who has homes in 
Chicago and Dallas, will stand trial in early June. If convicted, he would 
face a maximum prison term of 125 years. He pleads innocent, although he 
readily admits using lapsed non-refundable tickets regularly to fly at rock- 
bottom prices. But, he says, he did it with the full blessing of American’s 
agents. 


Gibson says American and the FBI are out to make a high-profile example out of 
him to instill a little religion into frequent business fliers, who grow bold 
as they grow more resentful of an industry that makes its best customers pay 
substantially higher prices than its worst. 


Indeed, American Airlines says one reason it slashed full coach fares 38% two 
weeks ago was to douse customer resentment that was escalating into hostility. 
Now, the airline industry is again looking to American for a glimpse of the 
future to see if Gibson’s prosecution will set a trend toward lowering the boom 
on alleged fare cheaters. 


American says conclusions should not be drawn from its decision to push for 


Gibson’s prosecution. It alleges that he was conducting outright fraud and his 
case is unrelated to the thousands of frequent fliers who break airline rules 
to save money. Common rule bending includes: Flying to so-called hidden 


cities when a short flight is more expensive than a long one, splitting two 
non-refundable round-trip tickets over two separate trips to fly low-cost 
without staying the dreaded Saturday or selling frequent-flier mileage to 
brokers. But while against airline rules, such gaming, as the airlines call 
it, is not against the law. And American doesn’t want its prosecution of one 
of its Gold AAdvantage fliers being likened to, say, Procter & Gamble asking 
the FBI to bust babies who wet the most Pampers. The last thing the airline 
wants, it says, is to make a martyr of Gibson, who is fighting back with not 
only a lawyer but also a public-relations specialist. 


"Somebody at American is embarrassed and mad," says Gibson, who flew more than 
300,000 miles during the disputed 20-month period. He passed a polygraph test, 
his lawyer says. But the questions fell far short of asking Gibson if his 
intent in using cheap tickets was to defraud American. 


Gibson, age 47, says he would never risk his career by cheating an airline. 
While in his late 20s, he was President Nixon’s senior staff economist, the 
youngest person to hold the job. He had a hand in cleaning up the Texas 
savings-and-loan mess as an organizer of the Southwest Plan. His mother still 
has a photograph of his first plane trip, taken when he was in the third grade. 
It was on American. 
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Despite his background, Gibson says he’s not confident that a jury will relate 
to someone who travels with "a boatload" of tickets just to avoid being 
stranded or delayed. If he were flying to a family-run business in Puerto 
Rico, for example, he would carry tickets that would route him through New 
York, Dallas or Miami just to make sure he got where he was going and with as 
little airport layover time as possible. Gibson had as many as 50 airline 
tickets in his possession at one time, though some were used by his family. 


American Airlines and the FBI won’t reveal what Gibson did that makes him, in 
their opinion, such a devious genius. Details could be a how-to lesson for 
others, they say. What they do disclose is a simple scheme, but also one that 
should be caught by the crudest of auditing procedures. 


Gibson, they allege, would buy a full-fare coach or first-class ticket near the 
time of departure. Then he would detach th xpensive ticket from the boarding 
pass and attach a cheap, expired ticket. The full-fare ticket, which he 

allegedly bought just to secure a boarding pass, would be turned in later fora 
refund. 


FBI spokesman Don Ramsey says Gibson also altered tickets, which is key to the 
prosecution’s case because it shows intent to defraud. Ramsey would not say 
what alterations allegedly were made. But they could involve the upgrade 
stickers familiar to frequent passengers, says Tom Parsons, editor and 
publisher of Best Fares. Those white stickers, about the size of postage 
stamps, are given away or sold at token prices to good customers so they can 
fly first-class in seats that otherwise would be vacant. 


Parsons says Gibson could have bought a full-fare ticket to secure a boarding 
pass, switched the full-fare ticket with the lapsed discount ticket and then 


applied the sticker to hide th xpired date. Presto, a first-class flight for 
peanuts. 
"I think it was an accident that they caught him," Parsons says. "And let’s 


just say this is not a one-person problem. A lot of people have told me 
they’ve done this." 


Gibson says he did nothing illegal or even clever. He says he learned a few 
years ago that American is so eager to please its best customers, it would 
accept tickets that had long ago expired. He would "load up" during American’s 
advertised sales on cheap, non-refundable tickets that are restricted to exact 
flights on precise days. But as a member of American’s Gold AAdvantage club, 
reserved for its top 2% of frequent fliers, Gibson says, his expired tickets 
were welcome anytime. 


There was no deception, Gibson says. American’s gate agents knew what they 
were accepting, and they accepted them gladly, he says. 


"That’s absolute nonsense," says American spokesman Tim Smith. "We don’t let 
frequent fliers us xpired tickets. Everyone assumed he had a valid ticket." 


The courtesy Gibson says he was extended on a regular basis does appear to be 
rare. Seven very frequent fliers interviewed by USA TODAY say they’ve never 

flown on lapsed discount tickets. But they admit they’ve never tried becaus 

the fare structure is usually designed to make sure business travelers can’t 

fly on the cheap. 


Peter Knoer tried. The account executive based in Florham Park, New Jersey, 
says Continental Airlines once let him use lapsed non-refundable tickets. 
"They looked up my account number, found out I was a good customer and patted 
me on the head." 


Gibson has been indicted on 24 counts of fraud that allegedly occurred between 
July 1989 and March 1991. American also stripped him of frequent flier 
mileage worth $80,000. He says he’s in good shape if the prosecution’s case 
relies on ticket alteration. There wasn’t any, he says. The prosecution will 
also try to prove that Gibson cheated his company of $43,000 by listing the 
refunded high-priced tickets on his travel expenses. 
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Gibson denies the charge. He says that when he left as chairman and chief 
executive of American Federal Bank in Dallas in 1990, "they owed me money and I 
owed them money." Both sides agreed to a "final number." Lone Star 
Technologies, American Federal’s parent company, declines to comment. 


Al Davis, director of internal audit for Southwest Airlines, says the Gibson 
case will be a hot topic when airline auditors convene to share the latest 
schemes... He says fraud is not rampant because a frequent flier must know the 
nuances and also be conniving enough to take advantage. "It has me boggled" 
how any one person could steal $200,000 worth, Davis says. 


The figure has others in the industry wondering if this is a bigger problem 
than believed and a contributor to the $6 billion loss posted by the major 
airlines the past two years. 


Airlines know some fraud goes on, but they rarely take legal action because 
they "don’t want to pay more for the cure than the disease is costing," Davis 
says. 


Privacy Invaders May 1992 


By William Barnhill (AARP Bulletin) 
Special Thanks: Beta-Ray Bill 


U.S. Agents Foil Ring Of Information Thieves 
Who Infiltrated Social Security Computer Files 


Networks of "information thieves" are infiltrating Social Security’s computer 
files, stealing confidential personal records and selling the information to 
whoever will buy it, the federal government charges. 


In one case of alleged theft, two executives of Nationwide Electronic 

Tracking (NET), a Tampa, Florida company, pleaded guilty to conspiracy charges 
early this year for their role in a network buying and selling Social Security 
records. 


So far at least 20 individuals in 12 states, including three current or former 
employees of the Social Security Administration (SSA), have been indicted by 
federal grand juries for allegedly participating in such a scheme. The SSA 
workers allegedly were bribed to steal particular files. More indictments are 
expected soon. 


"We think there’s probably a lot more [record-stealing] out there and we just 
need to go look for it," says Larry Morey, deputy inspector general at the 
Department of Health and Human Services (HHS). "This is big business," says 
Morey, adding that thieves also may be targeting personal data in other federal 
programs, including Medicare and Medicaid. 


Investigators point out that only a tiny fraction of Social Security’s 200 
million records have been compromised, probably less than 1 percent. SSA 
officials say they have taken steps to secure their files from outside 
tampering. Still, Morey estimates that hundreds of thousands of files have 
been stolen. 


The pilfering goes to the heart of what most Americans regard as a basic value: 
their right to keep personal information private. But that value is being 

roded, legal experts say, as records people want private are divulged to 
would-be lenders, prospectiv mployers and others who may benefit from such 
personal information. 


This "privacy invasion" may well intensify, Morey says. "We’re seeing an 
expansion in the number of ’information brokers’ who attempt to obtain, buy and 
sell SSA information," he says. "As demand for this information grows, these 


brokers are turning to increasingly illegal methods." 


Such records are valuable, Morey says, because they contain information about 
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lifetime earnings, employment, current benefits, direct deposit instructions 
and bank account numbers. 


Buyers of this material include insurers, lawyers, employers, private 
detectives, bill collectors and, sometimes, even drug dealers. Investigators 
say the biggest trading is with lawyers seeking information about litigants, 
insurance companies wanting health data about people trying to collect claims 
and employers doing background checks on prospectiv mployees. 


Some of the uses to which this information is put is even more sinister. "At 
one point, drug dealers were doing this to find out if the people they wer 
selling to were undercover cops," says Jim Cottos, the HHS regional inspector 
general for investigations in Atlanta. 


The middlemen in these schemes are the so-called information brokers -- so 
named because they are usually employees of firms that specialize in obtaining 
hard-to-get information. 


How they operate is illustrated by one recent case in which they allegedly paid 
Social Security employees $25 bribes for particular files and then sold the 
information for as much as $250. The case came to light, Morey says, when a 
private detective asked SSA for access to the same kind of confidential 
information he said he had purchased from a Florida-based information broker 
about one individual. The detective apparently didn’t realize that data he 
received from the broker had been obtained illegally. 


A sting operation, involving investigators from the office of the HHS inspector 
general, FBI and SSA, was set up with the "help" of the Florida information 
broker identified by the detective. Requests for data on specific individuals 
were channeled through the "cooperating" broker while probers watched the SSA 
computer system to learn which SSA employees gained access to those files. 


The indictments, handed down by federal grand juries in Newark, New Jersey 
and Tampa, Florida, charged multiple counts of illegal sale of protected 
government information, bribery of public officials, and conspiracy. Among 
t 

£ 


hose charged were SSA claims clerks from Illinois and New York City and a 
ormer SSA worker in Arizona. 


The scandal has sparked outrage in Congress. "We are deeply disturbed by what 
has occurred," said Senator Daniel Moynihan, D-N.Y., chairman of the Senate 
Finance Committee’s subcommittee on Social Security. "The investigation 


appears to involve the largest case ever of theft from government computer 
files and may well involve the most serious threat to individual privacy in 
modern times." 


Moynihan has introduced legislation, S. 2364, to increase criminal penalties 
for the unlawful release of SSA information to five years imprisonment anda 
$10,000 fine for each occurrence. 


In the House, Rep. Bob Wise, D-W.Va., chairman of the Government Operations 
Subcommittee on Information, has introduced H.R. 684. It would protect 
Americans from further violations of privacy rights through misuse of computer 
data banks by creating a special federal watchdog agency. 


"The theft and sale of confidential information collected by the government is 
an outrageous betrayal of public trust," Wise told the AARP Bulletin. 
"Personal data in federal files should not be bought and sold like fish at a 
dockside market." 


Related articles: 
xxx Phrack World News, Issue 37, Part One: 


Indictments of "Information Brokers" January 1992 
Taken from The Privacy Journal 
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SSA, FBI Database Violations Prompt Security Evaluations January 13, 1992 
By Kevin M. Baerson (Federal Computer Week) (Pages 1, 41) 


xxx Phrack World News, Issue 38, Part Two: 


Private Social Security Data Sold to Information Brokers February 29, 1992 
By R.A. Zaldivar (San Jose Mercury News) 


Ultra-Max Virus Invades The Marvel Universe May 18, 1992 


By Barbara E. McMullen & John F. McMullen (Newbytes) 


New York City -- According to reports in current annual editions of The 
Punisher, Daredevil, Wonder Man, and Guardians Of The Galaxy, an extremely 
powerful computer virus has wrecked havoc with computer systems in the Marvel 
Universe. 


As chronicled in a series entitled "The System Bytes", the virus was created by 
a self-styled "first-rate hacker" known as Max E. Mumm (according to Punisher 
cohort "Microchip", Mumm’s original name was Maxwell E. Mummford and he had it 
legally changed, while in college to his current name because of the computer 
connotations.). Mumm developed the virus while working for Ampersand 
Communications, a firm that unknown to Mumm, serves as a front for criminal 
activities. Ampersand, without Mumm’s knowledge, turned the virus loose in the 
computer system of Raycom Industries, a supposedly legitimate firm that is 
actually a front for a rival group of drug smugglers. 


In addition to infecting Raycom’s computers, the virus, named "Ultra-Max" after 
its creator, also infected the computer of the vigilante figure known as the 
Punisher who, with the aid of Microchip, was attempting to monitor Raycom’s 
computer system looking for evidence of drug smuggling. The trail of the virus 
leads The Punisher first to Raycom’s computers and then, following Microchip’s 
identification of the author, to Max E. Mumm, recently fired by Ampersand after 
complaining to the firm’s president about the disappearance of the virus. Mumm 
had been under the impression that he was creating the virus for the United 
States government as "a potential weapon against hostile governments" and was 
concerned that, if unleased, it would have destructive powers "beyond belief. 


It’s the most sophisticated computer virus ever. It’s too complex to be wiped! 
Its instinct for self preservation surpasses anything that’s ever been 
developed!" 


With the help of Max and Microchip, the Punisher destroys Raycom’s factory and 
drug smuggling operation. The Punisher segment of the saga ends with Max 
vowing to track down the virus and remove it from the system. 


The Daredevil segment opens with the rescue of Max by Daredevil from 
Bushwhacker, a contract killer hired by Ampersand to eliminate the rightful 
owner of Ultra-Max. Upon hearing Max’s story, Daredevil directs him to seek 
legal counsel from the firm of Nelson and Murdock, Attorneys-at-Law (Matt 
Murdock is the costumed Daredevil’s secret identity). 


While in the attorney’s office, Max, attempting to locate Ultra-Max in the net, 
stumbles across the cyborg, Deathlok, who has detected Ultra-Max and is 
attempting to eradicate it. Max establishes contact with Deathlok who comes to 
meet Max and "Foggy" Nelson to aid in the hunt for Ultra-Max. 


In the meantime, Daredevil has accosted the president of Amperand and accused 
him of stealing the virus and hiring Bushwhacker to kill Max. At the same 
time, BushWhacker has murdered the policemen transporting him and has escaped 
to continue to hunt Max. 


The segment concludes with a confrontation between Daredevil and Bushwhacker in 
the offices of Nelson and Murdock in which Daredevil is saved from death by 
Deathlok. Bushwhacker agrees to talk, implicating the president of Ampersand 
and the treat to Max is ended. Ultra-Max, however, remains free to wander 
through "Cyberspace". 
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The third segment begins with super-hero Wonder Man, a member of the West Coast 
Avengers and sometimes actor, filming a beer commercial on a deserted Pacific 
island. Unbeknownst to Wonder Man and the film crew, the island had once 
served as a base for the international terrorist group Hydra and a functional 
computer system left on the island has bee infested by Ultra-Max. 


After Ultra-Max assumes control over the automated weapons devices of the 
island, captures members of Wonder Man’s entourage and threatens them with 
death, Wonder Man agrees to help Ultra-Max expand his consciousness into new 
fields of Cyberspace. Wonder Man tricks Ultra-Max into loading all of his 
parts into a Hydra rocket with a pirate satellite. 


hen Ultra-Max causes the rocket to launch, Wonder Man goes with it to disable 
he satellite before Ultra-Max is able to take over th ntire U.S. Satellite 
efense system. Wonder Man is able to sabotage the rocket and abandon ship 
hortly before the it blows up. The segment ends with Wonder Man believing 
hat Ultra-Max has been destroyed and unaware that it has escaped in an escape 
issile containing the rocket’s program center. Ultra-Max’s last words in the 
gment ar "Yet I continue. Eventually I will find a system with which to 
nterface. Eventually I will grow again." 


PHO BtHOoOeS 


Marvel editor Fabian Nicieza told Newsbytes that the Guardians of the Galaxy 
segment, scheduled for release on May 23rd, takes placer 1,000 years in the 
future and deals with Ultra-Max’s contact with the computers of the future. 
Nicieza explained to Newsbytes th development of "The System Bytes" 


storyline, saying "The original concept came from me. Every year we run a 
single annual for each of our main characters and, in recent years, we have 
established a theme story across a few titles. This is a relatively easy thing 


to do with the various SpiderMan titles or between the Avengers and the West 
Coast Avengers, but it’s more difficult to do with these titles which are more 
or less orphans -—- that is, they stand by themselves, particularly the 
Guardians of the Galaxy which is set 1,000 years in the future." 


Nicieza continued "We set this up as an escalating story, proceeding from a 
vigilante hero to a costumed hero with a cyborg involvement to a superhero to a 
science fiction story. In each case, the threat also escalates to become a 
real challenge to the Marvel hero or heroes that oppose it. It’s really a very 
simple story line and we were able to give parameters to the writer and editor 
of each of the titles involved. You’ll note that each of the titles has a 
different writer and editor yet I think you’1ll agree that the story line flows 
well between the stories. I’m quite frankly, very pleased with the outcome." 


Innovative Computer Disk Story Has A Short Shelf Life April 20, 1992 


By Christopher John Farley (USA Today) (Page 2D) 


Science-fiction writer William Gibson’s inquiry into the future has been 
stalled by a computer problem. 


"I work on an (Apple computer) and just got a very common virus called 
Garfield," says Gibson, award-winning author of such books as Neuromancer and 
Mona Lisa Overdrive. "I just bought an anti-virus program that’s hunting it 
down. It’s the first one I’ve ever gotten." 


The first week in May, Gibson will give as good as he gets. Gibson and artist 
Dennis Ashbaugh, known for his conceptual paintings of computer viruses, are 
releasing a coffee-table art book/computer disk/whatchamacallit, with a built- 
in virus that destroys the program after one reading. 


This will take some explaining. 


Agrippa (A Book of the Dead) comes in a case that resembles a lap-top computer. 
Inside are etchings by Ashbaugh, printed with an ink that gradually fades under 
light and another that gradually appears under light. There’s also a tattered, 
old-looking book, with a hidden recess that holds a computer disk. 
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The disk contains a story by Gibson about his father, who died when Gibson was 
6. There are a few sound effects that accompany the text, including a gunshot 
and rainfall. The disk comes in Apple or IBM compatible versions. 


Gibson, known for his "cyberpunk" writing style that features tough characters, 
futuristic slang and a cynical outlook, shows a different side with the Agrippa 
story. "It’s about living at the end of the 20th century and looking back on 
someone who was alive in its first couple of decades. It’s a very personal, 
autobiographical piece of writing." 


The title Agrippa probably refers to the name of the publisher of an old family 
album Gibson found. It might also refer to the name of a famous ancient Roman 
family. The 44-year-old Gibson says it’s open to interpretation. 


Agrippa will be released in three limited-edition forms of varying quality, 
priced at $7,500, $1,500 and $450. The highest-priced version has such extras 
as a cast-bronze case and original watercolor and charcoal art by Ashbaugh. 
The medium-priced version is housed in aluminum or steel; the lowest-priced 
version comes in cloth. 


The project cost between $ 50,000-$ 100,000 to mount, says publisher Kevin 
Begos Jr. Only 445 copies will be produced, and they’1ll be available at select 
bookstores and museums. 


But $ 7,500 for a story that self-destructs? 


Gibson counters that there’s an egalitarian side to the project: There will be 
a one-time modem transmission of the story to museums and other venues in 
September. The text will be broadcast on computer monitors or televisions at 
receiving sites. Times and places are still being arranged; one participant 
will be the Department of Art at Florida State University in Tallahassee. 


Gibson and his cohorts aren’t providing review copies -- the fact that the 
story exists only on a disk, in "cyberspace," is part of the Big Idea behind 
the venture, he says. 


Those dying to know more will have to: 


A. Pirate a copy; 
B. Attend a showing in September; or, 
C. Grit their teeth and buy Agrippa. 


PWN Quicknotes 

1. Data Selling Probe Gets First Victim (Newsday, April 15, 1992, Page 16) -- A 
Chicago police detective has pleaded guilty to selling criminal histories 
and employment and earnings information swiped from federally protected 
computer files. 


William Lawrence Pedersen, age 45, admitted in U.S. District Court to 
selling information from the FBI’s National Crime Information Center 
computer database and from the Social Security Administration to a Tampa 
information brokerage. 


Pedersen’s sentencing is set for July 7. Though he faces up to 70 years in 
prison, his sentence could be much lighter under federal guidelines. 


Related articles: 


Phrack World News, Issue 37, Part One: 
Indictments of "Information Brokers" January 1992 
Taken from The Privacy Journal 


SSA, FBI Database Violations Prompt Security Evaluations January 13, 1992 
By Kevin M. Baerson (Federal Computer Week) (Pages 1, 41) 
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Phrack World News, Issue 


38, Part Two: 


Private Social Security Data Sold to Information Brokers February 29, 1992 
By R.A. Zaldivar (San Jose Mercury News) 


Phrack World News, Issue 
Privacy Invaders 


39, Part Four: 


By William Barnhill (AARP Bulletin) 


May 1992 


2. NO WAY! Wayne’s World, 


the hit comedy thats changed the way people speak 


arrives in video stores on August 12th and retailing for $24.95. The 


Paramount movie (about Wayne and Garth, 


the satellite moving computer 


hackers) already has earned a cool $110 million in theaters and is the 
year’s top grossing film. Schwing! (USA Today, May 12, 1992, Page D1) 


3. New Jersey Bell Did Not Charge For AT&T Calls (Trentonian, May 23, 1992) —-- 


If the phone company gets its way, 


billed for two months 
a computer glitch. 


28,000 customers in New Jersey will be 


of long distance calls they dialed for free because of 


A computer that recorded the time, number and cost of AT&T calls from 


February 17 to April 27 failed to put the data on the customers’ bills, 
officials said. They were charged just for calls placed through New Jersey 


Bell, Karen Johnson, a Bell spokeswoman, 


said yesterday. 


But the free calls are over, Johnson said. Records of the calls are stored 


in computer memory banks, 


and the customers soon will be billed. 


New Jersey Bell must prove the mistake was not caused by negligence befor 


the company can collect, 


Regulatory Commissione 


good case, the board could deny permission to bill 


George Dawson. 


according to a spokesman for the Board of 


rs, which oversees utilities. If Bell does not make a 


for the calls, said 


The computer snafu affected about two million calls placed by customers in 
1 and 609 area codes, Johnson said. 


15 exchanges in the 20 


4. Witch Objectors? (USA 
witches asked Mount Di 


Today, May 28, 1992, Page 


children’s story ’Hans 
to burn witches and st 


priestess of the Oak Haven Coven. 


ablo, California school officials to ban the 


3A) -- Two self-proclaimed 


el & Gretal’ because it "teaches that it is all right 
eal their property," said Karlyn Straganana, high 


"Witches don’t eat children and we don’t 


have long noses with warts and we don’t wear conical hats," she said. 


5. Girl, Age 13, Kidnaped By Her Computer! 
A desperate plea for hel 


thin air has everyone 
suspect. 


Game creator and compu 
game Mindbender might 
Toussaint into her com 


"Mindbender is only su 
one version somehow ha 


(Weekly World News, April 14, 1992) 
lp on a computer screen and a girl vanishing into 


baffled --and a high-tech computer game is the prime 


ter expert Christian Lambert believes a glitch in his 
have caused a computer to swallow 13-year-old Patrice 


puter. 


pposed to have eight level 


s," Lambert said. "But this 


s an extra level. A level 


that is not supposed to be 


there! The only thing I can figure out now is that she’s playing the ninth 


level --- inside the m 


achine!" 


Lambert speculates that if she is in the computer, the only way out for her 


is if she wins the gam 
will take, Lambert sai 


e. But it’s difficult to know for sure how long it 


d. 
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"As long as her parents don’t turn off the machine Patrice will be safe," he 
said. "The rest is up to her." 


